71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f

Analysis

max time kernel
600s
max time network
485s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2025 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpyNote_v6.4/Resources/Clients/KingB_354051091211537/Settings/2021-11-9--11-07-16.html
Size

5KB
MD5

ebbd85872881ea5b9062e582425e133b
SHA1

dbe89aabc9f3330205893c1e81e4f75a4adaa253
SHA256

c403aca8d1faf420dec4ce43fc27e8f5e980cc68619c79265a555227ab6c0f6b
SHA512

836edded1673c5a508d28fabaf970e098c0237177cacb901a5c95cccd641b1c8726ea7aa7fb77fb20a08b9b41e096eaf4bded8065afb90e35b5ba2e7444fe498
SSDEEP

48:yfUp0WhAx1FYVFdFqxyyTaqgD6FT1hg7tT/fd1/ha1B5dNM121H7/B9sWVYP0u1N:qRFAwO96Fuf6/HWP5RnjefI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
4984	msedge.exe
4984	msedge.exe
2944	identity_helper.exe
2944	identity_helper.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3684	4984	msedge.exe	86
PID 4984 wrote to memory of 3684	4984	msedge.exe	86
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 4496	4984	msedge.exe	87
PID 4984 wrote to memory of 5052	4984	msedge.exe	88
PID 4984 wrote to memory of 5052	4984	msedge.exe	88
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89
PID 4984 wrote to memory of 1072	4984	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\Resources\Clients\KingB_354051091211537\Settings\2021-11-9--11-07-16.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd28c946f8,0x7ffd28c94708,0x7ffd28c94718
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11987703738846006775,13897109578744966676,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cf0d12cad4c4cc7c2fe1daa59995cfd4

SHA1
f51a86acb90e7d9065270ed0e04b38d5bc54042f

SHA256
b0fdea5fbcfa795d8165445dc5bae9837ba12c93e6a27bae8888d1585944a745

SHA512
fe2c0a62cf312a651a0977b132e9ed43f9777a69a0393e7ac85b428f5f4deddb210b562247222968cc217d9fd0e21b571d00165ee0e63597d8663a7f5e5ddae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b70adb9c619dff10d2dcb7f926b9ec3b

SHA1
ad6ab490a1527d6a056055ab5a50395c2496d4fc

SHA256
ac0ff4d0e002d553021c6b0fc324efa915ce2d5ef2d1691de247e9929fa29b00

SHA512
b53b6e5c13344d7e219bd27cdb9c89a6d27cbe3ac462dc8c25691cb2c92f4c42a3fe0be806c7f4f4c48d3183229948ac453cb4310f521806e38f623fdaa31165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45210c42dde9770e41e779542042353a

SHA1
30b1b6fd66712fef2315d245f7cd1f6952bba49f

SHA256
df1c2d95002c0bac399863d1924bf9edbc6546871d5fac5e357874c47fb0d11e

SHA512
9d792896ab6ec81ce98bd41701750f390b7ee69f0ee067a308bc6f78499846e8bb47c19f3238e8d152192d3cb8729900a9d66482ea6eb6c82167dd1337ceaebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ab693c83b3853a42a995751fc0b27a9

SHA1
e3db9c9ccb5ded917eef831af5236243691ad305

SHA256
b0b51319552c56a4197564f5d9a3c2e21e0598f97f27aef6334762375b9dc5cc

SHA512
c39a055935563010bea8003d73863371ab50dcf8516dafd58be8d98be515cfc43aa0568fd35345f2492acb4242fb12e1e2e4620e7f94528405b1f6a09cc5d572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b6dd88c11e1d0754d3261520ca872e41

SHA1
6360da54f097ef63c2b07950303def4d49e1678c

SHA256
95a3e80043b05e3a034d6bc0a1f3ce8100338536c24a68fa7d2ae89ada6429c9

SHA512
c704da1be1dbafb8167e291e150a4415f394efed70f8ebf2ec7298f45797ae06f3292f4e2119d51db1593f0be3779cff91e0404fd1008cf50fe160cb50838894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e74dcbddae1d28f0a84e6cdbc8765b94

SHA1
0a8b0706e9bc6d8b7c046a356573f20121712987

SHA256
6a07dd2fd4cb734aba9711c5993499fca586c135becd2faf3348af368190ee28

SHA512
b0de5d53e1d887a79626ad534172ce552b6e19074cd2ba2d16c0aa135de89dbe72c80c4750cd539a5cfa9ff5546b12841a4c830e56f736e6591e127ba6fe59c5

Download Submit