hxxp://aegis[.]adp[.]com/assets/public/filesharedownloadlink[.]html?emailId=98650167-34bf-47bf-ac49-db45423bef48&fileshareredirecturl=hxxp://ww3knu[.]southwiltonsmiles[.]com/bWlkb3JpLmVuZG9Ac2llbWVuc2dhbWVzYS5jb20=

Analysis

max time kernel
83s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://aegis.adp.com/assets/public/filesharedownloadlink.html?emailId=98650167-34bf-47bf-ac49-db45423bef48&fileshareredirecturl=http://ww3knu.southwiltonsmiles.com/bWlkb3JpLmVuZG9Ac2llbWVuc2dhbWVzYS5jb20=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
2020	msedge.exe
2020	msedge.exe
4564	identity_helper.exe
4564	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 228	2020	msedge.exe	50
PID 2020 wrote to memory of 228	2020	msedge.exe	50
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 4028	2020	msedge.exe	87
PID 2020 wrote to memory of 3792	2020	msedge.exe	88
PID 2020 wrote to memory of 3792	2020	msedge.exe	88
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89
PID 2020 wrote to memory of 4852	2020	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://aegis.adp.com/assets/public/filesharedownloadlink.html?emailId=98650167-34bf-47bf-ac49-db45423bef48&fileshareredirecturl=http://ww3knu.southwiltonsmiles.com/bWlkb3JpLmVuZG9Ac2llbWVuc2dhbWVzYS5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee30c46f8,0x7ffee30c4708,0x7ffee30c4718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14587061893105300957,5782707927929742750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
bc13df366ab1a8e29390b697387e51d0

SHA1
e7f7775404385944f7ecd2ac4931dee58444038c

SHA256
ee235fda89998bae5d2b7c91811374aa20cf37794e78edc90865142e814e5075

SHA512
746f817fcd5b7f9c786efde71a858014d28e313cdcec7932b877755c499e6d368a08a33456f6b9ddfe2c9c8e70b88d5126ee4348d3d94d0b011fe19d403cbadb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
712B

MD5
dd97d8762e6bf06f2be3cb6e6b89d84c

SHA1
a8fafb4235306c2362b32f9ef93dd5246fd47f17

SHA256
0fb51ebfa5f1e2a3ace195002b752c097962b61e56323b3632ac3998130ce996

SHA512
ed63d51af3093188cd4aa633128bd5097468f6d1b103e1e677e953ef1a49925821e3edac4056b8fad62d2f954c097d012912b70b72e78b4006d1ed5249c5b9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b45e180f228d78542b10c33772570bc6

SHA1
89a4979552e990612a9560ab778d03f4270e0b08

SHA256
fb9734ebc017d85bb2e8561d68d1e90873be99309583b8cb92518e25bccecfd8

SHA512
7d427f4a0aaacbaadae0a8c12653c5e3b20a998a1908741c8fabf97572c1f44f16f54a7f2eabf6390742c27ca39679cb9363b1b76491ee5d297a1763026bdc62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8763699110f947737aca1fb9e419bcf

SHA1
8fd552f8ae4dc604abc8e17c1116d1f0df2f95f5

SHA256
b6bdd281e0ab60ac133957da4486cbbe0d48b71550e20e72688b69c0197862b7

SHA512
573833253109063660740fb442f904293321e17d7cfa0280856e3f8923fd34e6c3ce8ae2e9661d59a85f24baf134a26b08b838d25a88860d3237e8b64b9580bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b4f66cc07111698d44635e2464ef443f

SHA1
1f5041db909e11a729f8c9048813eee8ae016b92

SHA256
ed6501f9dea419cf8876eda444987058c28d3795325f3bec8904117772a79cad

SHA512
880dc1114b12efc4d29d3414f64673a66ad0a18db98bd1f682823f279c4d8f3281eeb05044f4fc80948fa450706a17ad0551418a2ce9bc311383254c7226f2c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7fe4334a6c9d5c0f06e6db225fa4634c

SHA1
e11b93aaa29ddaaf3f58340d532b2bf14bd0d8f8

SHA256
1181b8c758b15d43cb2aa705a46e063e24b6f0507d8412ff80c787ca3fd53a17

SHA512
2e169f0bc7f89f563619a003f7bd721b710397cf5fd7807bc7d6fcca3acd9dd79ed4db575935dc3765a69ffe612b2372d771954ba9e2fc872302b165c115f988

Download Submit