hxxps://3k7[.]fe3[.]mywebsitetransfer[.]com/

Analysis

max time kernel
44s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2023, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://3k7.fe3.mywebsitetransfer.com/

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
892	msedge.exe
892	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4612	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
892	msedge.exe
892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1952	892	msedge.exe	82
PID 892 wrote to memory of 1952	892	msedge.exe	82
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 2400	892	msedge.exe	84
PID 892 wrote to memory of 1660	892	msedge.exe	83
PID 892 wrote to memory of 1660	892	msedge.exe	83
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85
PID 892 wrote to memory of 4044	892	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://3k7.fe3.mywebsitetransfer.com/
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd65b46f8,0x7ffcd65b4708,0x7ffcd65b4718
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9192690787164559710,11695739782677863374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9192690787164559710,11695739782677863374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9192690787164559710,11695739782677863374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9192690787164559710,11695739782677863374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9192690787164559710,11695739782677863374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,9192690787164559710,11695739782677863374,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4640

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x344 0x2c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9360964793323152c8b422796423789c

SHA1
beeee134f7531f410bf3abc05fa4fc4149e9892c

SHA256
ce7d598b01ea6d36023b66e7bf0dc02438aff2625502f429416f70bf9e3af84e

SHA512
b4dc4e3a77af6188fe96f7603a951c4473152337d92240f30e24704ed1bbe4bbd5dd5ac8b5b7497d302d9c769fc914c830766387f93eaae868663eaaca149042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb3a2a7b01dcc4016392245c291d334d

SHA1
24fdb9268335bdbe9debf5876adc09240bc68ef3

SHA256
32ccc3ad23dabe07636848f3aff53556e6cf2c2166dbfd8de5eed8509cd1ddee

SHA512
4d4d98804794ad8d704dcb04960a90780b5a139e06a957f74436fd2cff166abfe5a1e6704d47892092681947d399e0b2121e7aa74081c285f7def89c0e049f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d7fbb62cbef1acfa17d1c9d578c40921

SHA1
63e8201f0d99470feb16872d0647f69ab550140f

SHA256
cd8b7afddd3ef27e9a8f6180c461a3cf8536178e0cb0ce2e60f3c01beff5bd0c

SHA512
bb00828606dacb68e747e38f7ae56479ab48b39514a709006de4b77a9119b14756399b0f6b516c2a54d8b3b6b4c6aeca9a89b72c201a89e3958253d730b43877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c0c79b9765e276f3a21e27c1e64cccd

SHA1
4d5aa608f719cb6284ee93f0b3940ef664f33ba2

SHA256
3c21ce813df879d4b0f4238a0d67f024cffb431bea9a7ab869638143a4cef542

SHA512
88f2f3743db1c521215b5e25a902da6279d1a8e80ee6003557ef4e832926dc447833ffd26969c44c8124ec075910f86db876907884ca7629e9b90a90437b59fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b3b3b61ad2196e8fec243128665d2178

SHA1
3117b49d2d6ac91743841856bc2fbc2e75b5c869

SHA256
3a3be664183203d56b8aed17f35c43382fa1ef7b29f5d093b2ddc83c9d780d04

SHA512
add2cc3c351d2720125d182e63c13d14a38895399111b92b0290aae2263fd3eee2766665db65da6eed165b34e49add94a50ad1c8cd7cb1643235af80c7a4e9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d398c72d210340b8f342e7ae9bb21dfc

SHA1
484d9708f8deff0d7dd190d60a28a1b582cb190f

SHA256
989eb2ca46dda46e66bdb033d88978458ad4b76ad0ba18628754f31f0a3419a1

SHA512
789425b3f0cbeca6bb716282f194b03d0a28bc77f73e0d8f2947c11e283197ecc56ca916a79f2db9bdcce1c77a1eec00779893e23311eac1da50f8f7478790e6

Download Submit