Overview
overview
9Static
static
7Fix+Licens...re.dll
windows7-x64
1Fix+Licens...re.dll
windows10-2004-x64
1Fix+Licens...EN.exe
windows7-x64
9Fix+Licens...EN.exe
windows10-2004-x64
9Join Teleg...re.url
windows7-x64
1Join Teleg...re.url
windows10-2004-x64
1binaryninj...64.exe
windows7-x64
4binaryninj...64.exe
windows10-2004-x64
4$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Qt6Core.dll
windows7-x64
1Qt6Core.dll
windows10-2004-x64
1Qt6Gui.dll
windows7-x64
1Qt6Gui.dll
windows10-2004-x64
1Qt6Network.dll
windows7-x64
1Qt6Network.dll
windows10-2004-x64
1Qt6PrintSupport.dll
windows7-x64
1Qt6PrintSupport.dll
windows10-2004-x64
1Qt6Qml.dll
windows7-x64
1Qt6Qml.dll
windows10-2004-x64
1Qt6QmlModels.dll
windows7-x64
1Qt6QmlModels.dll
windows10-2004-x64
1Qt6Svg.dll
windows7-x64
1Qt6Svg.dll
windows10-2004-x64
1Qt6Widgets.dll
windows7-x64
1Qt6Widgets.dll
windows10-2004-x64
1api-docs/_...a.html
windows7-x64
1api-docs/_...a.html
windows10-2004-x64
1Analysis
-
max time kernel
0s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 03:19
Behavioral task
behavioral1
Sample
Fix+License+Keygen/Fix+License/binaryninjacore.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Fix+License+Keygen/Fix+License/binaryninjacore.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Fix+License+Keygen/Keygen+Patch/KEYGEN.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Fix+License+Keygen/Keygen+Patch/KEYGEN.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Join Telegram for more.url
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
Join Telegram for more.url
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
binaryninja_personal_dev_win64.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
binaryninja_personal_dev_win64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Qt6Core.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Qt6Core.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Qt6Gui.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Qt6Gui.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Qt6Network.dll
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
Qt6Network.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Qt6PrintSupport.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Qt6PrintSupport.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Qt6Qml.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
Qt6Qml.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
Qt6QmlModels.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Qt6QmlModels.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
Qt6Svg.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Qt6Svg.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Qt6Widgets.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
Qt6Widgets.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
api-docs/_modules/binaryninja.html
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
api-docs/_modules/binaryninja.html
Resource
win10v2004-20240508-en
General
-
Target
api-docs/_modules/binaryninja.html
-
Size
67KB
-
MD5
4cc9beb65f021a0db7d389315e9ecea4
-
SHA1
ba435a218a960f5f9a4b8fcc09dd760cf35bfa04
-
SHA256
d69a640f68f3c8d17f61f53367c15fdc442f36a7b0b9c5f709caa2a9efdd53b8
-
SHA512
b03ae586782e1aad1caeb4d7451001804809f7aba3fa522a770c529ac803135446f34886ae723a5e7551f220e54455230f894c5e3151ba3869f8cbcc63089b5c
-
SSDEEP
1536:7wpHIlBaTsZ7QdiSlAllFSIFGflNojYLRXY:6cBaTsZ7QdNAllFSIFGdNosLRXY
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
msedge.exedescription pid process target process PID 860 wrote to memory of 2904 860 msedge.exe msedge.exe PID 860 wrote to memory of 2904 860 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\api-docs\_modules\binaryninja.html1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff394d46f8,0x7fff394d4708,0x7fff394d47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5938933820007457627,1724462370610544294,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:22⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD558d7a3ca5eda5ad1619a46a23fd9b509
SHA149d1183646e2f916a2de0a67b7fd8b7a707df870
SHA25669ffba93856d5eb3de74c64017adef90f93ff333a21fdaf2cf5440b2b79f8650
SHA5120f658dee31f4050e14822731537b50441aeb4357c97ed48912d93eb8afbddf510817554cbbdf635737594da8d73f894d20c65c848165300ab2ee38e9c024e680
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57ceebfff46125164d9ffa0f46bff5b08
SHA14e4a456a7a62222c68d12a5db3f8ca07771486fa
SHA256568d34c8036b9a721a87b6d87fe57813ff9d066019f511444734970046c1c146
SHA51259c597710b915616480546a7fce02ca55ad417c0813ba10ace0d68cb334d3de93a216c22024513c33efdb27f36a4db9d753bc11dcb58bf3f47a65305c700f030
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD58273537bb1cd0c7a63c94c418ac0a52b
SHA17c6eeed6b2f4d27c4b7053b2288fbac23a007a7e
SHA2569da328cb86a986d60794e86a19625a73c80acb51cb10b57170722a41b331c464
SHA512dc82cb11f069cc18b26dedfada8b060dd7e05f55aa05deb9c6d9b5b5b15c247049f2ab3782d97aaf728b708cf8c830687a448877f06664607c6b4a85ebd9ff3c
-
\??\pipe\LOCAL\crashpad_860_SMKAYMIUOCFKYKPDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e