hxxps://github[.]com/bryv2/infinity-5[.]3

Analysis

max time kernel
240s
max time network
279s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
01-12-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/bryv2/infinity-5.3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
3128	msedge.exe
3128	msedge.exe
2592	msedge.exe
2592	msedge.exe
4320	msedge.exe
4320	msedge.exe
4020	identity_helper.exe
4020	identity_helper.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 2592 wrote to memory of 1476	2592	msedge.exe	77
PID 2592 wrote to memory of 1476	2592	msedge.exe	77
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3068	2592	msedge.exe	78
PID 2592 wrote to memory of 3128	2592	msedge.exe	79
PID 2592 wrote to memory of 3128	2592	msedge.exe	79
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80
PID 2592 wrote to memory of 3080	2592	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/bryv2/infinity-5.3
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xe4,0xe8,0xdc,0xe0,0x10c,0x7fffeda43cb8,0x7fffeda43cc8,0x7fffeda43cd8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12837054833208955917,1371236355906494147,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d6c344b8b66485fd178bb551dd194709

SHA1
52dde0659f3c52300f8c30209986aa09124c4f04

SHA256
22290994d5bc98c3dc624eab8f161fc4c0411eb88b2d3dcaa736624cf41926b6

SHA512
6f8ff0973a6da5120dace4d52edaa2b0ca93f732e1de3d23c72545d4eb430a6ae870c6ce3743b4e47e24a5e74524993587b8b848042c571f3f9087d0295332dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
32a343478aee973ec889ef38dcb3eaf3

SHA1
4bc74c9818c556166d51b2d2d8cea09aa435fb10

SHA256
f7cf7b718bc3785ecf8f679d63ed3fe05b4ea5aa90b4675ad0ddfe0da4de344b

SHA512
d8b9feefdd3af65b418517ea47e764f4ccc5f6b89b886ac0bf7630e47292e5cea478e1cf05796a72f8590ff768eb4b25ce1daf026f117155887fc9d1054c8c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
204c08b8a46b9c9ebcbaf02a2b2b7412

SHA1
8306362ce6b4aa62ec79a6c7288b124896b0d0ef

SHA256
1b83b587a8adc749941d2460f90e55d14830a1a4ef3b139768963d0d4157dbf7

SHA512
86bfc20d0e680bc1c77529f0df8474df0b79fe686c471f6550835f76914c52200b33f2035e58333e176a72966c4c2ee09378f960b1bcd6d0d8a209cfbd3bcde2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
802c9fc31dcab48d4a1892d4c62f98b1

SHA1
2b1c6cb6a64dac8609bc9fd271358e971107f955

SHA256
acb1914ad4b1eb82f050f78d379d003f2166cbb0a8a9d3a08d939b771192bbb6

SHA512
7b9254b269712292e852e18a4312a17d7da3eb0d9e985defc263b2d1b381ea5df90286596507805186258895f6f9fea690601320d097a92d09646fe6a2767565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a45351eea6211108439725fd40e8cc2e

SHA1
09ceee0a51c01373aef58a3bf56459e9ed2fc6ad

SHA256
24894810cb6af17d2bf51eba70fa46a9487b8c59c03225a0daeeeb09b78db117

SHA512
7acb5a272826b3027e0c342ebf3eb4d2baf55646902158b14dd59ec10c8b0f1572d408aac823c20692f27947909d050c874cd3de055121f3df1c0e5318e68dd6

Download Submit
\??\pipe\LOCAL\crashpad_2592_HKEYDHRXESDEWLSQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit