hxxp://ato[.]gov[.]au/disasters

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2023 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ato.gov.au/disasters

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1520	msedge.exe
1520	msedge.exe
1628	msedge.exe
1628	msedge.exe
1564	identity_helper.exe
1564	identity_helper.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4320	1628	msedge.exe	84
PID 1628 wrote to memory of 4320	1628	msedge.exe	84
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 4752	1628	msedge.exe	86
PID 1628 wrote to memory of 1520	1628	msedge.exe	85
PID 1628 wrote to memory of 1520	1628	msedge.exe	85
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87
PID 1628 wrote to memory of 4724	1628	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ato.gov.au/disasters
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff936a646f8,0x7ff936a64708,0x7ff936a64718
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15711936282482709758,18238044871668962272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bd2fcd4b20a1afca1a752955cc0cdecd

SHA1
9ac885a74cd1c3f025dccbaf467686d1d2f10855

SHA256
396ecad7148a4f2d4eb76fb66b0543434ddf7406ef16d70b559e9b6ea48f9308

SHA512
c8e88e73756bf3567cd5af70172b9cec6f955cd02613dee05c11f417dc1baea5f4a795d456c8d1c2a35ae117cdc3a7f6d2251701e2d4b0be5d36466ef826743f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cce7da7956e53949447ab896a54e64fb

SHA1
314c40c91c8e8a1ee15d33887c34c177dea7ec44

SHA256
26d86633a286a0b6e425786bed35bb4b38b28449d0cf79d6e9fe7d5548de90b7

SHA512
b4a8cfe35f92338c1787fc78605189bf165ca5be3bf59895759746f5a9388e5ca30c7aab9978c06dd9cf85c7b5c1b0ea2b66cb468701a29ffb801bdce744bf30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f8c5e0c6cdf5967d03ae2e0fee6d9a7

SHA1
82f49141b2ebcdc3e4059086aedb39e9c471197d

SHA256
f4c2c6dc269bbbc438148d58cf82cfe1bd2a41bef71fe90dfc4b3277e7565678

SHA512
7d6f600d1cef21eb5777311a3c62da3590c0aeb98640a5d512e38fa49c434c3af30f4981a3ac7ab2a0e3cb4ef65fb46f396162182c763663c232ec6763032659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d681f96c-5376-483b-9bdb-caad9bd41d2d.tmp

Filesize
6KB

MD5
1238e311f2b74a7ca5ba06bee98a25ff

SHA1
ae7cc5b1a7d896531d2983de155bc8f503297729

SHA256
add596e58d30feb2be681d8b72c988023a814a4a37c4440f88afea58cdc171da

SHA512
8c2a39c60210101e31b95daf3dda1c75c64f5c4f3788ab46f178172b62f6522f5fe2a5925e9028f2f2567d58398b9b6747c349c2bb5805c661c9f1bd1247a92b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d335fd501705eace061fc1d947e25349

SHA1
c54a9df0217d944ebc094704b196d0b84f0a9878

SHA256
12e139ec46aff6217516e75a600d094bb6bbc21d27fa1d942cf14094fabdeafd

SHA512
9ab79ebef56ba3bace804b767e3e78074759aa64614b7c10b71b2f30c0e310a4208b328b46af9791e9e18601559386bb9541a0dc8079376424c3ff056a94700e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
50542c7d1e4ef6d08a956e5bbeadef46

SHA1
09676579c0967834721c630de7d4e9fe096c9959

SHA256
bfc3c31f261647d6a0002a902ae1d35d215843879826a37dbc4995a2bdae23f6

SHA512
3b0005b5cf17d4bb0261a8850160cc9d2e5a8684022ce0654855b27e3e4eb858229a1778bfbb7106a0b48da8166f16a69d1062b66efc70ce4d1aa5b672896d26

Download Submit