hxxp://ncv[.]microsoft[.]com/qzgTZQFBoy

Analysis

max time kernel
30s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ncv.microsoft.com/qzgTZQFBoy

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3392	msedge.exe
3392	msedge.exe
4204	identity_helper.exe
4204	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 1880	3392	msedge.exe	83
PID 3392 wrote to memory of 1880	3392	msedge.exe	83
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 5036	3392	msedge.exe	84
PID 3392 wrote to memory of 3968	3392	msedge.exe	85
PID 3392 wrote to memory of 3968	3392	msedge.exe	85
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87
PID 3392 wrote to memory of 3328	3392	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ncv.microsoft.com/qzgTZQFBoy
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1aae46f8,0x7ffa1aae4708,0x7ffa1aae4718
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,77750225131926523,3016029880954589468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
492c89bda9875ae87050bb75c0795aa6

SHA1
28054e112c0b1d0381b2b12b75cfffa1865bcf47

SHA256
98e23ac9e8a9bdb9116590f6b8cf1e71bddb583bd2774a1d2ac54d05c8e85947

SHA512
25d578f619f00bc0981d0ca01be0537e4a703c5c7807cc503f546c2fc0a64aadc13b8bc098130a8af4d073e3a3fe079d3caa8836890bde70abe861725894df5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ade4a19e877aa91b9aebd1e52ee608d6

SHA1
9e366ceae73fa80eea858c6ce46bb62f530bb258

SHA256
5b952e121df0921d15a15c6544a3cac02d0f73ee128fb8a8ccf349e75d3d37df

SHA512
b4960ca3eddc0d6b93467aa76a93a2b637a4a397e92ad2c99b48968d44ffcefb6da0793b1ba9ab06de916edac630d08954088ece56847a96c6df56217624f4ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
1c9bf3e0f662befbfc9baf25c1702582

SHA1
9a2ac887a2a469c3985b3071bc141bc49f09131e

SHA256
70896aa767fe013ac726d9d4ee687c5064e71deeb50d23702713e35c7b30f2f3

SHA512
839765bbbd399ce985261a9e8024ee50cabdcfc6f38bc2ee19a8e57dd1e1b0e1718b13d9998e6e1ecbf157aa733e57fc582d6be4783602658347eab047c66e26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dddd.TMP

Filesize
538B

MD5
371558c46840dc9d635ebd2f94ed626f

SHA1
665e5ccd9455e808625d62f2d81cfabd7ee25405

SHA256
94881cb68d16d538da217f8a30bb276015935880646b92b42786e196b60dacc8

SHA512
2dc640af82d2a94b946d4e92a02535723a1f57a84ac4cf86f0608927f9e88230ca1afeecd24107167942389e1555d7410e0680828f93b49dfd62673907945a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7b15c52-cdee-4b5d-a678-db3c48ba95bb.tmp

Filesize
12KB

MD5
aac3e4a28bb1d456f146a50086306e13

SHA1
7e7de77943d243c8b633d2a39322f87e9d88ab5e

SHA256
87c1062bf34d4ee32483766352205636b52697f08e3e6b782d866c8f7d390e19

SHA512
3ff15342979563d5fcda3a2bd6e3c0590e0d69a5dbf1d009a339cb9ba2da2b4688ce05abfc03eefe9d08f00436a04ff9082adc233dac38dd7f6f308790c959f0

Download Submit