Analysis
-
max time kernel
326s -
max time network
328s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://geode-sdk.org/
Resource
win10v2004-20241007-en
General
-
Target
https://geode-sdk.org/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4236 msedge.exe 4236 msedge.exe 884 msedge.exe 884 msedge.exe 3964 identity_helper.exe 3964 identity_helper.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe 884 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 884 wrote to memory of 2124 884 msedge.exe msedge.exe PID 884 wrote to memory of 2124 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 2472 884 msedge.exe msedge.exe PID 884 wrote to memory of 4236 884 msedge.exe msedge.exe PID 884 wrote to memory of 4236 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe PID 884 wrote to memory of 4012 884 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://geode-sdk.org/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa586746f8,0x7ffa58674708,0x7ffa586747182⤵PID:2124
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:2472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4236 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:4012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:3588
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:2856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:1004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:12⤵PID:2484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:4672
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:82⤵PID:2448
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,11506501116722399050,2397842390800011725,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3744
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3e3eba95-a617-4196-8a5e-bf76ea832bca.tmp
Filesize5KB
MD54ef4691bca00c38a03cdd046d7529082
SHA1daf94bdf829d50750607da7fada3717b919f08ce
SHA256152646797bbeee91169edfec4a6d53764c800a00c8dea86aee887ca3f5f79400
SHA512797e52f904ed93189611db0796a1a9f369b9d746d2fb5228c326085d9e3124df4ce58943875581b3fb2eea040e6d97a3470dcf998fb02f010d320063894f777b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize624B
MD53721ebfab8a94b6476c2775b74b2b237
SHA115cfc79b4c1c3e00dedea605baad6b05abde7145
SHA2563c505406b9615bbede1be3e9e04528a605eb8edd52526ce567785a318b997c94
SHA512d3222c9ce57e2ff254fb5b4848341f16913bed4543f0249a43011f56a89f0b876814f23a3d4f8ea277cc439ed5d4846befcc44a94114d0fbc5cd9e42a3c11d33
-
Filesize
965B
MD5a1f88e44b67ccd6058a36927900a2adb
SHA1e68ad7a49a114cc8b4f61c9cb151351ebfbe0f52
SHA256f72cbc6e2f2efd815ce4bfdc9cabbf966650c50c88bf0902d0758a4e9ed64a1e
SHA5127213a5c9c4e2acc775b2e5cbbd2953b410986dade27e06172ed0d5e56afa880585d679b6d60f644ef8496ab747c9d733242225752968fda2355daaa5b0db3049
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD58ac4da52b45782e4f9ad5541cbb84954
SHA1908a75fbea70ed88798591841e53a8d545ea0426
SHA2568cc3ab9e8da016d43b612dc4460ff179015029aff840898a5901e6c138751429
SHA512a787b6e6e2de251a9d35ce029253208ed7d100c4722abc9d56e4f032af03750208297cb13dc3ad59977ff616d612bd540d8acddf34bf48c1c18aad0e4519c716
-
Filesize
6KB
MD58371dc61b55027a73d4f6363bd0e3671
SHA146dfba435115a11c2e7067e726dd5cfb20c432d7
SHA256e82fbe19c1c4dd44b58ca048b5abf1df1b8c701d4298896cf0bfc3d2fea9229d
SHA512e3b91ab64675d20c41a87072a5bb17310be5830f2e9ea1bd30a543f4980e5a33e6abb4b90bea97bb53e62ebeb6345de39d58c9e308941aba743e6857f7b986da
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5007ee380ca38df071c65a20c435db988
SHA11cdfe3e96a2fcf66878b5c19c2abc1063bfdf3f2
SHA2561dd358bf1a205e7578d15b79ad2209164663a0606ecfeafb59530ffa00bfdba9
SHA5128f62a2b5850ef176df199882ec348e8d60cf86afc3e587df63e20ffb766f0dfdd6d884af5245dff0939af45f5c4f3aa3bc26fe11121baf1defeb19bdac81271a
-
Filesize
10KB
MD51c200bc8f46ce41c34cc5edc02b0c726
SHA1144b2b3593698926bc16c70433143a1b9eddf40c
SHA25682daff0a755bafe1d3ac55a4cea817bad40234176f01219ba47b5b302317b73e
SHA512d7974e73e1c31e74238dde4dcadfcf7960aa0ec979b681020b27e79ffe4e85303fd42f99f7a8bc5145a033fc29ea5ef1ed306148d0793a6dbd8957b1c09b4182
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e