hxxp://publicinput[.]co

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://publicinput.co

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
3536	msedge.exe
3536	msedge.exe
2648	identity_helper.exe
2648	identity_helper.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 4160	3536	msedge.exe	37
PID 3536 wrote to memory of 4160	3536	msedge.exe	37
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 4472	3536	msedge.exe	87
PID 3536 wrote to memory of 2592	3536	msedge.exe	86
PID 3536 wrote to memory of 2592	3536	msedge.exe	86
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88
PID 3536 wrote to memory of 432	3536	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://publicinput.co
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c60446f8,0x7ff9c6044708,0x7ff9c6044718
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,527887846494292666,4922152174528331961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
7b3d2f1018c91cfb1b19e848858dcf68

SHA1
0d35791c29192ee4d8116718606319eeb6ded379

SHA256
1c7f62f929a9d51684a5e9868735bfd77ad2f1caa80c57a75fefe84d4ebe2181

SHA512
059b6a37f945a9339a4d4096144f4b6a8c143df02254fec5779311dd49a0ebf5ad1338a0757bc092997470e98d227e3ab0a560eb9ff7b5a9a0f6b57ac61e66fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
193B

MD5
99ae22c3441935823773507e91d038ce

SHA1
29dc5ca8ed6b844aae14c360526cb4c3677838c1

SHA256
a862ee17d7503f740784dc7a4dd81c458bc4ca5e18af54b104d51bbb1b518bf3

SHA512
f715252d5a32c50a11147d416b430028a02b9fd748d14d20754b5d1412f2a97daf770321af3d9a06255698d88d9265782bd6d1017ee82407eaf3ff3a13206691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aaaef6c68c4fae03d5225063fdca4501

SHA1
a7e2d02c36c5f4b6f64a42926b7f10dbcd69ee96

SHA256
8cf0a1827927e66308cc32ee65106e63ab2b309267449fa455e331b8323907bf

SHA512
352dc7c4f82579927b385ea4943f45071fc5b6b19c9f1c79fb2523e2d48dd6887427a5e51a77132c4fea8c8af6a179900fd65b82eb546493c2e7f8ba7cc5a85f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cbf37277971acd87726b9ab44b4c7ccc

SHA1
f3f2cd4898c3aa2bd714680e4118e2d71861fece

SHA256
8391ea2c237e954ef999a7ccb74837e994b7b15e0e37d8fb2901e326159adb4a

SHA512
bdb2036accb1f38ab549616d33ba7aa3e51b44991c6032bd2c984f34647db758a461c701a6de1ab0a2d1277da8719d22469c2c3c07771e6c839f9fc9260a1388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2da47e63b8d53a0926f8f9f7d28cd898

SHA1
0575349b7780632cac3b303c5a2da0f5c24155be

SHA256
d3a074d0d309216256e45582f77b7f60ea1ca017818e950be6ea37379a80ec43

SHA512
d2d4ccc08c65f2a468f3dcd9fdadedbdf27fb820dd3d0169d4f7a920f4dcff7c520f3dd4d136dc881f6eb5a741d2e3b7ad30311dc27216a8311c640f3f3ec001

Download Submit