bf58f9a6d18ab45df57f517cef3c338628122be7663252f37c72add00de0619f

Resubmissions

20/02/2025, 23:44

250220-3rgd5syjdj 6

20/02/2025, 01:27

11/02/2025, 13:10

09/02/2025, 18:24

08/02/2025, 15:46

07/02/2025, 16:24

29/01/2025, 23:50

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2025, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xeno-v1.1.4-x64/bin/Monaco/index.html
Size

164KB
MD5

001dcbb8f41cdcbf9b4d1e3a0ed4b2d2
SHA1

982a05814546017c40771e59e7677b53d84787e9
SHA256

f1d2c52f2803c29585b81d2eff74c56242d27e9619ee6d38081d5604c5bb1951
SHA512

9a4eba2a9314b6f5851997e1db0ecfae8e40da3443d8a5f9df933ccf6a4d75fc330888c8d14818326e15b3dec9ae2f5f7e73cd08c3822dd7eb0b2d753c8cd8fa
SSDEEP

3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pblM:64J09BA3pZaFD48VOAGUWYPjdlLJbRBS

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3980	msedge.exe
3980	msedge.exe
1756	identity_helper.exe
1756	identity_helper.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3380	3980	msedge.exe	85
PID 3980 wrote to memory of 3380	3980	msedge.exe	85
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 1232	3980	msedge.exe	87
PID 3980 wrote to memory of 3752	3980	msedge.exe	88
PID 3980 wrote to memory of 3752	3980	msedge.exe	88
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89
PID 3980 wrote to memory of 2100	3980	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.4-x64\bin\Monaco\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0c4146f8,0x7ffc0c414708,0x7ffc0c414718
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9346956501806563895,10291220151302723443,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e77abac3d03f5b27ca6d587bff7cfce4

SHA1
2398274b1f425b428b6860d225d691ccd6cac355

SHA256
eb56f6b62d68039ebff870d1968be6d2499c3ef9046555c20b1623eaeadf5c03

SHA512
bfb7aa7973e3ef57df95a42c7ce0e7ec1fa4afe0276802f38f3791e4a4d2aa9af300887fbca7297b75276415ecae7cc7ac0c413a3c95345e7b3354407c770a7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71678a9de9a3336190ff95537cd87a7b

SHA1
9e213afb4f6397c8e64c2bcb8cd36931845a0474

SHA256
ac58d2d4beb00dc62fb0a5b50cac02d2529cb51733065ca5f1763bd810371c3c

SHA512
5f402598e4533d1a25e802353387725753ce54c7638515f91d80db2eed13ee9a676ae401e47ab424f57bdd5f3d6b75e577027fee10ded7cea0d99cbbd3c0c937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
193B

MD5
62fc8758c85fb0d08cd24eeddafeda2c

SHA1
320fc202790b0ca6f65ff67e9397440c7d97eb20

SHA256
ee0d15dce841e092ad1a2d4346a612410f8f950fdb019bc7b768f6346f2b5248

SHA512
ca97e615bdcac137a936c10104a702e1529ed3470828f2c3a2f783345ebbef04cac8c051df636c714151671efea53a9b8912b6b0d0b5eafdac5fae1dfdc8f85d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
acbb3241af748b3659cac8ff6b65aec9

SHA1
032b6aede0bbaffbc577bd23eabfcceebf40858f

SHA256
d8448fd0b750e20b45f4d05465d03e7714466390f90089d8ce5f8a2c7f3fe806

SHA512
45be62bf91739165010766090cf76a42a48d1fdd07f2348ef2f583dfc74a22080d3b439fd6a8eabca3c76e764dd1ac9bdcf6882778358eb5f58482c691aff547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87c3d1e55f2e01d18ea6350268fd37bd

SHA1
e77f0018a98ff523aeaae791900b5ef4e8eb0531

SHA256
82d368aec9cfd6284be43c09346f2da4fdf1f3a28b86deb3ae2659ebd6e710b6

SHA512
92b17a573fbf866648ababd67cad42551e5f97b47268c52362dd43006077bc4300b5f960efc2cc2b6a162ec107643eaa4befbc983db40098c05fdd3b7e8fa1c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4b1e7acd32825c7f744f494e7081e758

SHA1
eed26dc816512e0fa20db9c7d3fe946a2d7fe516

SHA256
253253417e3ebff861efe55924d12a6508f7a322b2c0cfa79fb8ec635cef9ffb

SHA512
d8c055b43d75b029908d10cb2d5310f99fdfaa741a406bd9cb2c6a7d606eaa1373dc8ae256403572ef9dbf60315505134fc668c9525cf76638c895a5d2f083c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
db4be243fc743db39b1109f2d89149a0

SHA1
afc2f4e6c1259cdc233eb93c64d6b56bf5425a74

SHA256
fbd9e003f916aab7b05d1afe0cb6755c626667365460d209929446a76153ad4b

SHA512
8c03a09a7cac10577eb177523985a575bb4d8c3e51f65778c85a918ea87114f53514688b6887da5e1f06f7fe041a9ed079ee7fa0087d2dea7330a92824efc8fd

Download Submit