hxxps://protect-us[.]mimecast[.]com/s/mJ20ClYmygTR7W5JIGsmIO

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2023 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://protect-us.mimecast.com/s/mJ20ClYmygTR7W5JIGsmIO

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1476	msedge.exe
1476	msedge.exe
3196	identity_helper.exe
3196	identity_helper.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 512	1476	msedge.exe	57
PID 1476 wrote to memory of 512	1476	msedge.exe	57
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 2064	1476	msedge.exe	82
PID 1476 wrote to memory of 1028	1476	msedge.exe	81
PID 1476 wrote to memory of 1028	1476	msedge.exe	81
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83
PID 1476 wrote to memory of 5060	1476	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://protect-us.mimecast.com/s/mJ20ClYmygTR7W5JIGsmIO
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3af746f8,0x7fff3af74708,0x7fff3af74718
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2508626092778831492,11257430507791838006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
c7331c1bd7da1da71be4649758b60b0f

SHA1
423877f1b990aa6e86a85ec5f35cf720c7332bd5

SHA256
26faca60b6a44f7b77d7268a60e9c5f504e750d57723e59ec343e5701aaeb015

SHA512
c17b17ba2016cdc87373a5aa2378dd599e0f13eee052de6dc64f7ad24418f43f9bd25b6e8a7ee0e2c215a3267d230a979df7dfd4651d57985c9e43ad5ad10a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6b7bd563da5b064faf4e09ae9fad5819

SHA1
1b8606d0d5daeea4a148acadec7488691264fae0

SHA256
aff516c4e539af6ed8681464ae73783e246289ddedb0ccdabb0b8db43785cb5f

SHA512
d9588214e0cbea40fe2789b457a79163b57d52bbdc0b0c558eedaecf44756cc6ebf071702db7c70e2fee35123960ea0989d9731666148aedd805cc6dc5319691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
580ade093ef90a531c05e4937ddb5557

SHA1
deed266ce9a7fe4dee509c468286a5ed8f1fafc0

SHA256
5d849aa74c4df436aea16d7c99c15d171ba521c7f26eccd3e6139023ffc71278

SHA512
cbdfb6470dd887618622112ce0c5881a7add75b20b4e18bd7291c3d5c0064ad67576d083e153991fdeb8714f7d790c9b868d34bf7283cc1f766d92960fd6d9ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
adaaedeb96c5344b5eb0f0f9b22cf6cb

SHA1
772e9f50c64685fab7f788ad8ad1e89fb3920a50

SHA256
40e0fbbb9cfdbc6f29b28f9533bb72563c6431be27b32d1c0c9605dc9b2353c2

SHA512
5f3ebc57fd3b13dd2ee8477180ba34b1db1e8101c85adbc88584e7e61e3c00b19f21e42af90878b555bad26c1e98a947c2c63aad922d1a6df9540284ad62276f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
ebe596ef7bb4f735751c4d38fb3f6b41

SHA1
a7cba1f01d6040e8c5bd2820bfabc3e2b4456089

SHA256
a9efd86c54785dc66e882292267c2760b306b8f2b718fb67ccea9788e106e77c

SHA512
1745ca9346938dbf19abd179a8e8e6e56b4b4a338d88a4ca89e9740423f4d56068f6d87af7cb89a26722ce4fefd61f75a7023811227765d59ec14dcd4df95191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe597c79.TMP

Filesize
539B

MD5
a75b91919451ed36a232030d2cc501e0

SHA1
c94fe7f1d9eb49c7a2bb4c1f606a6797b8c10abf

SHA256
4fa22858dbfb9afbc2a0ebd1be0de9ee04a5d52bddbb3519864e4657dfc28cfa

SHA512
f80499cca46efa57ece2e879700def3fea7fa97e1f2a7ec324a7bf101fd01bf7af0be82c12f1f65633dfb39b4bb45ffe573ef4b3e1cfa682fa493655f23ae2e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b34d0d66a0a0d102bbf854de50ead11b

SHA1
abefaa8f38a5fada4e7e2aea31567558fa6ee6ed

SHA256
494e4215cf7dcef0c5fad3c017f5dac1ac7c196df989ac5532807b990642e572

SHA512
e55da78573b2f14f748bdd145b40040528ac1d22f0d0ea3e65d080b4eb82f389b22b30d8b16395c0279661077e47567bb0e918b9429b5bc12028540fce712141

Download Submit