hxxps://onetomany[.]cumulo9[.]com/ch/41024/1nth2/2887901/BoChYkAz434lfOCcTEySGRvdxYQy41thfBFjtLpw[.]html

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://onetomany.cumulo9.com/ch/41024/1nth2/2887901/BoChYkAz434lfOCcTEySGRvdxYQy41thfBFjtLpw.html

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe
3896	msedge.exe
3896	msedge.exe
4144	identity_helper.exe
4144	identity_helper.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 3420	3896	msedge.exe	57
PID 3896 wrote to memory of 3420	3896	msedge.exe	57
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 4612	3896	msedge.exe	81
PID 3896 wrote to memory of 1544	3896	msedge.exe	82
PID 3896 wrote to memory of 1544	3896	msedge.exe	82
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84
PID 3896 wrote to memory of 452	3896	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onetomany.cumulo9.com/ch/41024/1nth2/2887901/BoChYkAz434lfOCcTEySGRvdxYQy41thfBFjtLpw.html
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff03df46f8,0x7fff03df4708,0x7fff03df4718
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17170183336403372162,14867847930593954690,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a5a5fa01e386cdcea5559dc3d87e10d3

SHA1
5a64f240d6b2ff8fb9a3833367c0b28c421c4409

SHA256
0cdbab2c7ab28ca92ab6b89a4b5ca25ab168401b1b9f38c78560605ce88bb274

SHA512
dae02f192dac347e40d8ca86fc1a6e9018674c15427c73ed648d64761277f2f47093b6fb8e92bd81f9d95c1fe9bb1b1f34ade878d9e5683b55f6f847053b38e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f6b7cc04a7ee1a72427e7ecaef8db2d4

SHA1
196eb89111d840fc18df4ef7e2e61e847e149987

SHA256
bc97f393447048b1e206e7650f598dbd40eb4ba28dfe51c7e7252ce2c7c3c9e0

SHA512
e351560c250b68d1445f4512a94c77b228adcab4ee12770cb8351931a14b077949b0ce7da748f1810d5276339d9c553f2fdd379d801a5f7e50cf69b9d8dfd694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
743a5783de840cb83ce5ceb9f81db6b9

SHA1
84d1ac124e9c128a2abb013c59e4259fe3ee8e87

SHA256
8fe54fca7b5b9347dc6f8a18d0060f62f8e806c9a61348249757a43f670ba188

SHA512
70b70f59ca72e435c0081c8a86f07d8c0b398dddf7b46cdf031392b0986e9475fdff63640436c02031d5f9d6880cb843a377249141be19f4f7d5e4bab5b3a11b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea8abddd1fe55c101d4ed0c79cc27d16

SHA1
b15e83982e789f61bc399d03f8e31e42e8463d68

SHA256
c2dae90fac8a29538ad49d057b581912ac1612d52e0865f20ab847111c8debd6

SHA512
980efe065608316dee0a304d79dd69e7cc9e6298837587fa34aac7843f7a5bca5a29a2a90ed9db11beaff60f8ee97c1bf2594996ec04c685ed682f2f56cac455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f5877a3156a3313fb1f79c502c62e77

SHA1
463b8f3fb58cf3dcd2f3cf12847afba76e7f7b1e

SHA256
1b00a3c6741235ab5dfaed12034e33dd0dcddd1c862c6647be5cdbe9135ddbc8

SHA512
81a4cd4bc5dc566804fb565b1b64d27e14fa8d5738a327716e2771f96e67c9d3519a6d4300c35d4d2c48547ce7e8a553fc04ccd5fddd3b00ef8f81366540a289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5b59ecf3bb52e14f46755adaaf84e3ed

SHA1
c270139f59797f73f6c326c1f76c195a41a323b8

SHA256
7bd2a00b66b3dddd148e1cac1e143197e72322ce7bf4e2c570de5797f13eb230

SHA512
e7824303152633f0a3932d468626d583fda7c92543e208d9a6d993b8ce0e801da284bacc232c1a3293b2e31f5534003e34881ed8d3ee2cd085eb9bbe38ea3fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8b3790c2a9ee081ae7b1d9a011e63610

SHA1
6c570da659d4f19ab2c24f2614e1c182a10ce706

SHA256
913e61c3f6efe8bb5e31cd1313c14fea426acabdd4c97b8236b9a25d92bf5205

SHA512
ee39d41bf35dc763923135f86a200e724625321039c5459998dfbbeea65b3cdffc183e200345184abc7d3f7750507d633bb891fa27acfda005cba683f87f717f

Download Submit