Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 00:39
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mlotfyzone.com/wp-includes/kr.html#[email protected]
Resource
win10v2004-20241007-en
General
-
Target
https://mlotfyzone.com/wp-includes/kr.html#[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1696 msedge.exe 1696 msedge.exe 3564 msedge.exe 3564 msedge.exe 812 identity_helper.exe 812 identity_helper.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe 3564 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 3184 3564 msedge.exe 83 PID 3564 wrote to memory of 3184 3564 msedge.exe 83 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1920 3564 msedge.exe 84 PID 3564 wrote to memory of 1696 3564 msedge.exe 85 PID 3564 wrote to memory of 1696 3564 msedge.exe 85 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86 PID 3564 wrote to memory of 3464 3564 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mlotfyzone.com/wp-includes/kr.html#[email protected]1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ef4b46f8,0x7ff9ef4b4708,0x7ff9ef4b47182⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:12⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:12⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:12⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14589537061398629008,18031277988077669751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5888 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1036
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD599afa4934d1e3c56bbce114b356e8a99
SHA13f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA25608e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA51276686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
-
Filesize
152B
MD5443a627d539ca4eab732bad0cbe7332b
SHA186b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA2561e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD52ada7ee1054a59e6cea29021e87ad6e3
SHA1a6a93855e443a7cc3e8f3a1e12145e80a36d5e42
SHA2563729b8e04ac5de28b6647675b8b21e818ab1be429460b272547ba3235cc0161e
SHA512e8fb9541a4f91c184d91ff7525cedb19c241509b3f03d7f20cd0edff6bb0bdd501e7cf0f5d2bfb33b866b34146dbbbc7da6d899630646c1340911465902059ee
-
Filesize
631B
MD558fd9028ed56c66f3e75b451b1183d8d
SHA1085d4755d89861ae8cf029be14f365b32278e4e9
SHA256c1a6e14aee298eb571e96ff802167896e8607ddcefaa0b3fcf89fe28428a3b26
SHA512d2fd252e2c8169fe0c284fa4677e45f309357258b7a2b216d9ef853b60a975247794d80589c7512293a3b24fa94af080edc21a1197d16a3aaba07c1c2e0bf7d5
-
Filesize
5KB
MD5ae3058b0b14edf4a91a4f04af96c135a
SHA147fb304ade73f7dd3d6ad0084d2c2385d1c6cc9e
SHA25692ba64f04cf7b35334a616c4788789fcdba955b9673157edd43d12bb3a69478a
SHA512c3b126d7ade9a2b0d8c41a25eda00bfb1835526b652ef262ef3c7d8708015c1e78720f815fb4f5159be7793fa69ffe8045669a12b5d7a8a5bc45bc4892be5700
-
Filesize
8KB
MD57edcb4480c488f043c6802774e501d2d
SHA1d897e7ee8f287f836e7082a9a608789e4aec8d3f
SHA256b3d3a336f0df02787a5482275164a6de93260bded2c87631fe689d837dee7c7c
SHA5126b1f192eeb4637c1c54d8b62c0f7a8f27ecdf36625316f73dd25f698687051631016c1869bbbd7ec124eeb78b6bbb76785d846acdfaa4ad07c2b755ebfd2fac0
-
Filesize
8KB
MD5d0d00ac2f9a08c1cb35de24aa92c7a34
SHA120b9320594678eb260bd2b14700abf42f9fb215e
SHA256c3f3bcdc0a7e2ca57de0189c527b35cd3223012cd66aa8c34b7a9661a1046f8c
SHA5122acc4bfdc163d430836e440cb9f80ce3b8bf7d012551393ad4b883c2e92917ff23f9e8e3fabeb26d4e6d46e295d22a4411c852b53a3e321ae9637848222ec737
-
Filesize
9KB
MD525ee9299be8dfcbc15eea674ceb79e31
SHA1d76832a2afa70965d06798e2e25a46c8a05d7776
SHA25628e3386dc6e597df7ef9070d1a2882f05b3e21ad8ed36427c71df00f5f682c7b
SHA51246463b3cc97c55d3af88a6581232bae5d98242be4254a0fd94abd90fdb11172e94fb8fa21982f9992f4466458c76580c38d3b15f723a97d1bd0b07e5baee6459
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD551e3d8ed59d0f12df0129b2a0f28e475
SHA13a01cc0917c21c6180856daa8acf2adb73c3687c
SHA256d92fa5160102261999f81247506c8afd09b0490ed3c8dc8104efb73471a0761d
SHA512fd32e414ffe9eeacb8aca480b4a0fb9a7c521f41b90d270e05861cd201aa1947f9f10a4e3271eee9c1a40cef04122881d594a7d567cda65f335793d6190a3f52
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84