hxxps://warwickwmg[.]eu[.]qualtrics[.]com/jfe/form/SV_cx96SeholyIxGg6

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2023 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://warwickwmg.eu.qualtrics.com/jfe/form/SV_cx96SeholyIxGg6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1004	msedge.exe
1004	msedge.exe
4160	identity_helper.exe
4160	identity_helper.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 2828	1004	msedge.exe	62
PID 1004 wrote to memory of 2828	1004	msedge.exe	62
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1552	1004	msedge.exe	87
PID 1004 wrote to memory of 1364	1004	msedge.exe	86
PID 1004 wrote to memory of 1364	1004	msedge.exe	86
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88
PID 1004 wrote to memory of 1648	1004	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://warwickwmg.eu.qualtrics.com/jfe/form/SV_cx96SeholyIxGg6
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba10746f8,0x7ffba1074708,0x7ffba1074718
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3355372697362104813,4023653015595357552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a0b6e06-5665-467b-b9c2-0ebb661bc72d.tmp

Filesize
5KB

MD5
c58a68e815d06d3786a90a7a5a19849a

SHA1
819696e0bcedd188e226ff5f55cb09fabbd71fda

SHA256
cb9252c67ea36651afc20bea2e46b1de31d5079a2159818614aa8277254826a1

SHA512
36fb6add4d9ebe2a4c05f743c7562f83cdabd986e9e1c83335037558c996aae6da0a728f60308f7ed3ddee5e7de99045885ff6d46321405af0af5d036f11c99c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
171KB

MD5
c0bc0b994480a92f5ea94ab56dcc59d2

SHA1
72ac4d14697052ab12f0832d1c0fb353e5255844

SHA256
5b8ab1fc5a86260762a3becc9791ace3def8b47fb6a26d90b1995914b728fd8b

SHA512
e14704f23eae7eed60b74437b88cc82dca5c3975fd09c3e163a3197b03479ed2f5dd0719caa3eb6376b77e0fb993d5571f04074f632fe0894ea8901ae12e7065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
5edb40b8357d6a4235fd664a270b7714

SHA1
ba5042c6d63a48fdcac1df0abeb398fbcbeb9e71

SHA256
790fd288161c4fdc4726c9bdcab58edfbbd7e23cbb63bbbb9624ca4d95f1e465

SHA512
f9942a4d7a30894d9e220a04d7bb562394af615d3d4ffd948890b870a17249472e817f9a130c06f47a95243fc4b5fe734566d346f11a67bfd189bad16dbed950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
900B

MD5
e19db3d61d3738ae345b98c44ea0b051

SHA1
53d4d4d99831477588fa8829a1a71e8c4ba1b3d8

SHA256
56fc91f41d00e752b9a5a7ec49674b49df6f1573d350b7c4102ce5293a955024

SHA512
7499cc6dbc6dd91024170381dcba261da262b9e94215f62baf06dc129d9258b679555e06fb974bfca1b5fb7b61fcffe7887fbd3dd5f35611307534ee75a3413d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b683a43c8da7ca99379211228be7ec4

SHA1
f93d6fdae600bc6f12c905fe3ba2ef63ac0dcd50

SHA256
08bdb1958bd8c236d5673f5ccd37a271f84470dcf7748fcec7e1dad2f19e4da8

SHA512
307fc0b6e8911a3cc925fb0932e87a4b306581cf5b75e64536e57bb6593dbe53591ba5b2924359f49f7bac0481156d433e60d96249807b0bd59a6db203ad1c6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
64449cb257a3c1be3749a12ba0dbe407

SHA1
e4ee01ece9cbe1b1ed1d6fb16a37959c0a83dd71

SHA256
ad84ffdefd2eb21582289c0241f6fbac9a2a6f7c615f0c6d5c5cc6fd10a6563b

SHA512
e0b2e846a2616aa292c01b68fc118dd83a58823d71e4fb2a452b562b5361488d2e1058bba8ce3c92420d5a0d160c1b72c2044ffba740eede12559c0b51f1c526

Download Submit