hxxps://spotistash[.]sellpass[.]io

Analysis

max time kernel
61s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2023, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://spotistash.sellpass.io

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
180	msedge.exe
180	msedge.exe
768	msedge.exe
768	msedge.exe
1520	identity_helper.exe
1520	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 3044	768	msedge.exe	85
PID 768 wrote to memory of 3044	768	msedge.exe	85
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 3468	768	msedge.exe	87
PID 768 wrote to memory of 180	768	msedge.exe	86
PID 768 wrote to memory of 180	768	msedge.exe	86
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88
PID 768 wrote to memory of 4904	768	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://spotistash.sellpass.io
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85eb346f8,0x7ff85eb34708,0x7ff85eb34718
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12380432094857160090,11193718638026530607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
a89804782964c2a4990e54b1ddd7225d

SHA1
089b295026f2bc7b146ed29de12ab23689d46e90

SHA256
2ad1f12ec751ab470e9cc44442aed786c7941e22a2ca7623b47f979ccf933385

SHA512
a931c73baa66eae4008ed26097694162c089df436da50b8c1adf4856f1d3401f8445252199861d76176d69cfa3c209ac49e93212cc84197b4d82a95204b6f841

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e2e7e721803ce2a6dbd7eeae093d7149

SHA1
38016192295a789ec405ecdc22e3f84651ebcb26

SHA256
e1aca7ce72fe6cd296ed8c8b7e8b2739ea26895ce45b478f0bfc78a428c44cbf

SHA512
5213e240642ec69a18c03461f406216ab27b09bcbb815bf1134561592fa743dc59fc1a0fb53e58adc7c3b20631e661a4b83b3dbc9e47742c49aa66129a8ec16a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3664b526fee3d93c0f8d1fc39e4c04be

SHA1
98cb610e53a9548bbe4d9118cfba9a390a13a8e0

SHA256
16f83177d63891e3f450bf4deb4dfa6b703ae1d1201e2f56929e04101b09d3c5

SHA512
d758a615d926893a51dbdec5d7f653e0ab582a564d7c906e01d408b10b10b6c2ac3e8f2a9ddd6c0e2a42692c9146766e38370f67c04eb4eeb3cfda97fa380c15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f4482aafa5f49d49e7c877dfefae67e7

SHA1
98bc3233b66f241f902c7adf1a4db0ea416d7281

SHA256
739c7d64699997e65dfa263a07237c3f3e13063233dd7cbc19d5e3579498960a

SHA512
529bbb8743ea177f6fccb7e13618b7bc03260dc79f8d1f4ef9eef0082a8dda70d9e0af09800ceab25859825ccb21abaee18ce91c3638dc491134bc1291f84f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
98af5801f74c1dd4a5f12ed2f5c9af46

SHA1
5e1d2eac6905498011e0b9467fac733979e01eb1

SHA256
d350d98f111becf10ce6c9eceb9846889bfc9d880cfd35c0b35b724fb18b9eb2

SHA512
934a81e2340057a279e3c01aeeb0faf67c0817d8fdeaef011779e180cd21c1cf8f69a4ba329db2b93ff55ff225c1f12c52f38bbad80334b414910601fae0d3fe

Download Submit