hxxps://sagittate-zollinger-4da9459675d1[.]herokuapp[.]com/m?mid=64c20fb452345b0001562c93

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2023 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sagittate-zollinger-4da9459675d1.herokuapp.com/m?mid=64c20fb452345b0001562c93

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
1552	msedge.exe
1552	msedge.exe
4760	identity_helper.exe
4760	identity_helper.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2864	1552	msedge.exe	50
PID 1552 wrote to memory of 2864	1552	msedge.exe	50
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 1988	1552	msedge.exe	89
PID 1552 wrote to memory of 4944	1552	msedge.exe	87
PID 1552 wrote to memory of 4944	1552	msedge.exe	87
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88
PID 1552 wrote to memory of 4160	1552	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sagittate-zollinger-4da9459675d1.herokuapp.com/m?mid=64c20fb452345b0001562c93
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2f5f46f8,0x7ffe2f5f4708,0x7ffe2f5f4718
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,7880742827140795951,7383329045423307177,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5608 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
399B

MD5
28c23b87ad9fa8b9c741f82e1416e4ab

SHA1
d08ccd29078a48397c5fb298f4529a2e693460d9

SHA256
5bbcac51ba23ef5f5a2c309e852c4b9446673aa51767e39c5165b477a53f8ee6

SHA512
f864679903fbb68bb1a1aae45a9e39e7a7e5d1c82fc48cc42c1a2e48c831143faeaaeaede806abfbaf315a8b41eaf758464bab0e80444c538f4900b1f6045df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fd76f1ed0f8d98b9482fd5fbcc110524

SHA1
b9f98cccdbf1c918290396623509045904d094d7

SHA256
5605e42933f88800638e9f7f24a07235312c7e362a41d86526dca19371cf787d

SHA512
027b79acbb50f268b2cc7411fb6ea63dd26fc7b4636233518987b7a9b7c6cd45e1b5ba0487fe68e0ccb41b143da9c14bb6bd33b321a3fe4e9a673b278be9f058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5163693f367107f530c33af725734bf0

SHA1
ac584664326d61d594e3c9c072a4ce1e9ea4e99d

SHA256
5acd07764cc8259a08781d3a1dfb9467af4eb0851a9c74d0457ce9ca67e1180c

SHA512
45f28891b460265082f69bb1c763bf244ffad1b52cfd10b791d48ac4d9ab763b87dc6f96d01fa4f62951c2b3a2bf6a362282899439f74877764e9954136818d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
87f515187514497c8d065242f7a5f5e1

SHA1
bc1e0b5622b1180e5b8032bb268eafe4e0931b86

SHA256
1e5461f80aa93188d9e41c9babccc5e4750e321739321a744c4db17b6e764832

SHA512
3b0a8f7b180c6d12d73c5e7bc35ce20e6959f3860a2b6624e0e2751ebee42526f5b82066613daccb6f9f21e10ede25921568e3ffc3123035573c7522bff60d6f

Download Submit