f39e596217d308c2af0a8ea4e9580315184db8d755066c56d49e7ea0c9713898

Analysis

max time kernel
50s
max time network
52s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19/11/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fundExecutable.bat
Size

20KB
MD5

7a88efc404488b8e3db19ff972c8df3a
SHA1

f0c28ca7bf143258a802a4e6ac86e4d3e3f5051f
SHA256

f39e596217d308c2af0a8ea4e9580315184db8d755066c56d49e7ea0c9713898
SHA512

6b88a1394d856e4eff071c48c165266a2d2702a7b49c23e7e813dad7ead8ea1dfb1d7432ac8d4adb7b37f9ce2757a9f7b86daa45e9347536c7fbe555c087b81c
SSDEEP

192:Sf9hKWKu7To1YYYFAI7VxhmjK3Sae2T3NcPXz9KpWC/6:G7SI7LcjVaeC3NcPj4pW/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
4008	timeout.exe
3340	timeout.exe
2820	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
1712	msedge.exe
1712	msedge.exe
2836	identity_helper.exe
2836	identity_helper.exe
2680	msedge.exe
2680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2792	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2792	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2396	4412	cmd.exe	80
PID 4412 wrote to memory of 2396	4412	cmd.exe	80
PID 4412 wrote to memory of 4008	4412	cmd.exe	81
PID 4412 wrote to memory of 4008	4412	cmd.exe	81
PID 4412 wrote to memory of 3340	4412	cmd.exe	84
PID 4412 wrote to memory of 3340	4412	cmd.exe	84
PID 4412 wrote to memory of 2820	4412	cmd.exe	85
PID 4412 wrote to memory of 2820	4412	cmd.exe	85
PID 4412 wrote to memory of 1712	4412	cmd.exe	86
PID 4412 wrote to memory of 1712	4412	cmd.exe	86
PID 1712 wrote to memory of 1612	1712	msedge.exe	89
PID 1712 wrote to memory of 1612	1712	msedge.exe	89
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 3840	1712	msedge.exe	90
PID 1712 wrote to memory of 5072	1712	msedge.exe	91
PID 1712 wrote to memory of 5072	1712	msedge.exe	91
PID 1712 wrote to memory of 2576	1712	msedge.exe	92
PID 1712 wrote to memory of 2576	1712	msedge.exe	92
PID 1712 wrote to memory of 2576	1712	msedge.exe	92
PID 1712 wrote to memory of 2576	1712	msedge.exe	92
PID 1712 wrote to memory of 2576	1712	msedge.exe	92
PID 1712 wrote to memory of 2576	1712	msedge.exe	92
PID 1712 wrote to memory of 2576	1712	msedge.exe	92
PID 1712 wrote to memory of 2576	1712	msedge.exe	92
PID 1712 wrote to memory of 2576	1712	msedge.exe	92
PID 1712 wrote to memory of 2576	1712	msedge.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fundExecutable.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2396
- C:\Windows\system32\timeout.exe
  timeout 1 /NOBREAK
  2⤵
  - Delays execution with timeout.exe
  PID:4008
- C:\Windows\system32\timeout.exe
  timeout 1 /NOBREAK
  2⤵
  - Delays execution with timeout.exe
  PID:3340
- C:\Windows\system32\timeout.exe
  timeout 1 /NOBREAK
  2⤵
  - Delays execution with timeout.exe
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mylivewallpapers.com/how-to-set-live-wallpaper-for-your-desktop-using-mlwapp/#
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbddb03cb8,0x7ffbddb03cc8,0x7ffbddb03cd8
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,4076017942697399433,7415275356366641894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
08f41df8959fb298b88c165a39358e69

SHA1
a38f58c95399f0a82d23e24205f43297abdaea39

SHA256
081a5920f0543c7f9a186e3f2add102ca09a0e2be0487307295c98b44a8b9821

SHA512
570445876e3645d8739179f63f35cada553eba01a5fd47d1a6b0269f231033f19079da32db7fe52b6669b13fd6437aa90b9477f4d6838038f708384a3d2fa80f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
53ecf8424ece366b0bee2df8e0b0cf61

SHA1
50556171a4583e0919a8a92a9e10a04e5a59d948

SHA256
48eee3f40daa87c159ef54c79371d89eb0bddaa5ba5c9936dea62ab99f5834ff

SHA512
b5b44a62963a007ca01726ae8151c409cf372c9f11f9db65208f518b77f1116412e194cd055e64f7671b8e23886973d9fa1750d77e9943b4c6d6aa089444281d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51574fc3d60c038d6c1210c9072b7f67

SHA1
34d3813e959cf8e46699dc481e9039ab88252375

SHA256
a836dd5dd51ef7e45da29dce8c7eea0add8d0343a6a5ef3e200b8ba3701a9df6

SHA512
9c4f3cc51de103ac0e17701baad3e785190dd081914c42323e7d418f0b9ac55d0e07eb05388c4cb87f475c5640d236158023a53dcb1493cb1f3120043b207ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1869a0ef2381c4bbf9b13a3ebcfe2d11

SHA1
3763f9bc8ce524d41bacbf5e8d33d7241b44ad74

SHA256
a38463268454cd7d111fb1831a1d74f792262051f4417cd6ef9ad44e6eacc454

SHA512
a7a5e340937ea632273b91f12af519a2afce6e82921262bc34f1ab7ed8a5d0c91aef830e1f0359cb062eb64a12461c4357827f78b7b2377111e5386c6e6e673f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ad8e577eaf6c521868ca0bd91b611c96

SHA1
ee224c7abecdd46d320604e7a8bf7552d8e0ae39

SHA256
068ad0835f6ccb6b80e0d3c0ee696e5b57eab75a1e910e8a474d204b1e2483d9

SHA512
140cf0459e70dcc7cef06af448b9b95c1ab1186d6f9f718a7b5215075164315bb207f42992f99c41b3d33f7b56c3d4127f094bb7186d86eb293e2f2cee4abd2e

Download Submit