Overview
overview
10Static
static
3Softcam li...iz.htm
windows7-x64
3Softcam li...iz.htm
windows10-2004-x64
3www.satnet...ll.exe
windows7-x64
10www.satnet...ll.exe
windows10-2004-x64
10www.satnet...iz.htm
windows7-x64
3www.satnet...iz.htm
windows10-2004-x64
3www.satnet...TE.url
windows7-x64
6www.satnet...TE.url
windows10-2004-x64
3www.satnet...iz.htm
windows7-x64
3www.satnet...iz.htm
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
28/11/2024, 16:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Softcam link www.satnet.biz.htm
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Softcam link www.satnet.biz.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
www.satnet.biz/Install.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
www.satnet.biz/Install.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral5
Sample
www.satnet.biz/Oktagon Softcam link www.satnet.biz.htm
Resource
win7-20241023-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
www.satnet.biz/Oktagon Softcam link www.satnet.biz.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
www.satnet.biz/SITE.url
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
www.satnet.biz/SITE.url
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
www.satnet.biz/www.satnet.biz.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
www.satnet.biz/www.satnet.biz.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target Softcam link www.satnet.biz.htm
- Size 8KB
- Sample241128-tzbzyssraw
- SHA256 eab287387197e7b5a78c0cb673ff8719d2059558918e5117f8b0fd052dc106b5
- MD5 138366e862b24e5035119c5272d57aa3
- SHA1 8035b85bfffa0591d3cc19f98c1140d5feb19f06
- SHA512 30c78ce65fe6658a56e9b94e743f73ef8f9e08a72b786d8837258f98298a05bb784e9435a8912dac7e6eabddebfb32cda92f779cacf0c861661b14082a23fb50
- SSDEEP 192:eCfy4AbY5z5gnn8AkABPaXf27Nuz0A0YC3yZvOZvbWN8ewMXnF:eCfV+Y5z5VAkABKWKUYKyRORb0jpXnF
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 3228 msedge.exe 3228 msedge.exe 1864 identity_helper.exe 1864 identity_helper.exe 372 msedge.exe 372 msedge.exe 372 msedge.exe 372 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3228 wrote to memory of 4200 3228 msedge.exe 84 PID 3228 wrote to memory of 4200 3228 msedge.exe 84 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 3372 3228 msedge.exe 85 PID 3228 wrote to memory of 1476 3228 msedge.exe 86 PID 3228 wrote to memory of 1476 3228 msedge.exe 86 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87 PID 3228 wrote to memory of 732 3228 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Softcam link www.satnet.biz.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb439c46f8,0x7ffb439c4708,0x7ffb439c47182⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16204394121288282136,251721738902531767,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:372
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3180
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
- MD5 dc058ebc0f8181946a312f0be99ed79c
- SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
- SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
- MD5 a0486d6f8406d852dd805b66ff467692
- SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
- SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a4f28f2-5c70-4471-b7c2-02780218f245.tmp
- Size 5KB
- SHA256 aa6307306ec3e44af32e21e4da51472fd78d6614822c5eb987fb7d7f1489805c
- MD5 1faf5e7e55ea7de0dcc0df9ae9b30fd7
- SHA1 781db6a49f45aed3e4dab9ee694cb583b6485247
- SHA512 2b11ca59ec8cd8d8d18a6e1b6cfa58d107383a43859e7d3ba784848c7db3376656e6533472442c2fe88c9b363a85ccd881de7b5e94e506b5a53247fd9b152763
- SSDEEP 96:nCKkpSlD16JwpvWMoiVmdeH5e7KsUWQyV+VDCziEwb:nFkyDwJGWMXMro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 196964911002abc996f607731f456e0b281bc2c770c62fbe3c7fcb8bc332875c
- MD5 3a5868d9c551ecbdaab906a9e413b04e
- SHA1 99dd99c4d7243c6a8fb5ab46c8e4c8422744a493
- SHA512 f3cf5a6251afefa67c7f3a5f4d67e1104b32c9f984c658cb5459c9ef0497313da40bafb38a3c9d1d252a3b7480e79267c5e6963737cfef58918bd3409f87805e
- SSDEEP 96:nCKkUSlD16JwpvWMoiVmdeH5e7KsUWQyV+VD7AiEwb:nFkfDwJGWMXMrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 0eb1f64c7171dcb98255681e867d632bc6116c828f8555f775bd0cdbedf3bc18
- MD5 b5fc64d0a560a69dad49e3626f8eb9e2
- SHA1 6e5de5991b8aa99cc1752ff4f121b889334c6ec9
- SHA512 43f3d6231211d0919d0efbb4b7284671fbeadbb25ca34216411fe3e4c2253217f3e0030137ecf09d73c0eb908204dc72b0c71d8feb637755a3d2d0b2c450f5a0
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5e2RU0YLkyomYdF980JQw7:A9iIxuERzA83h09RZxYt5e6mYi0Yju
- MD5 SHA1 SHA512 SSDEEP