Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2023 23:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://fancydating.life/?u=f6yp608&o=mctw1k1&t=evr
Resource
win10v2004-20230703-en
General
-
Target
https://fancydating.life/?u=f6yp608&o=mctw1k1&t=evr
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1476 msedge.exe 1476 msedge.exe 2524 msedge.exe 2524 msedge.exe 1372 identity_helper.exe 1372 identity_helper.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe 2524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2524 wrote to memory of 4232 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4232 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 4888 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 1476 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 1476 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe PID 2524 wrote to memory of 2816 2524 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://fancydating.life/?u=f6yp608&o=mctw1k1&t=evr1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff847a746f8,0x7ff847a74708,0x7ff847a747182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8063539847266762841,313536077529655020,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD570e2e6954b953053c0c4f3b6e6ad9330
SHA1cb61ba67b3bffa1d833bb85cc9547669ec46f62f
SHA256f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4
SHA512eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD591e8bc47e33d4b6d0bc34fa20d6f5ed9
SHA1a6c348ef36039645393d066a92da503bc031d19a
SHA256c814716d760f5f4499ffed9c697be65728a71296ec8443066d55260fd7687504
SHA5122bb1bb15a6f35e2e1a80b4318cffbd539f1f3c62273c2719271526232fa35bae73f71b9209226a0253692ab00e625b74b62d5d3371898b3db5525e0ebf51f858
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
512B
MD5d14a892a4e6b73e0b937c7426bce3520
SHA1dc983c0e6637c552693ef3e69a5a5f6718245017
SHA25660f9ba2f065e1a4fc4179b4374393f26178253562854386ed9333d808a465b23
SHA512915f43da790a9897a8ebb3507adbf2e385cf6caba0aa792edd33e4ffbc93d3c6aeabc3af7f4df738e7a55a3439a178e10d31a4ad2f095058946c522000e93a14
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5998d457770b8f74034cf4dc20358cf63
SHA1d9bb1107bf97eff23e30652013653ec5e0bdf87a
SHA256dd992f43d01d67c68bf6fefc9adbb37bd12aaa1523fa6a9a42d0035fe2994fae
SHA512b85b1a11472470367515e9a70cb68a25b7c37a9418fa52a10d9678a85299a25f6867a88fbcb6bd8f95be6621292de6dda0d27527e979a0eb6b622359d60a00d8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5388b9464e188aa2d0ec8f4f52b7c8cac
SHA1cd653f53912fd7c0771640b082cb451a5854f144
SHA2565abccfdebf44c0b16af7bfdbb1678ba08399835f415dea3341d8f63462d37fe9
SHA5129a75fe2a80250cbb95fd385ea23447ddc9280f587108072ae8f63942a9b7430df03e49c7b265cb7bf9eb69979ae016c2c1b533e6c91d0040b3a02754b0cefdec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD55a478f1e08816969e8214f982850b754
SHA11cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c
SHA256665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489
SHA5127e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5d3f24f9ff5571b7fc7778636232f7c81
SHA1c62d4a81c5b6aa6357c0c046d72d5e871222e832
SHA2565d5ac8b5131cbcd40230dccc17515b8ba9c7575874b7124bbc485e6541a6771f
SHA512eba81c2e13fe5445be63d59e69bbb477fb577e693d846cea0f8b134cd7cf6d1334de94ecbe34e60b3666a68b7281a9e2b8316139f2e40888340cecdf35af1c63
-
\??\pipe\LOCAL\crashpad_2524_MQBWOGRSCAZWAOQVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e