hxxp://email[.]praxischool[.]com/wf/open?upn=1ScKDY-2FP1hooMRRSG2OtsG7Mk1xz-2FivjZ-2BTT0rwgttNm2TLM-2BS1LBuv4gF09uG-2BZ-2FQP07qbx1xoMnUlmBXvrndAKlPBov5z69JVsBBwtueERpWVeMGFMvooKndiZEsZMD5whrqd5Mgz9kWARQ7-2BZ-2BCmepgkvmzdgxbKLf6sgpxThqCZocKFaXhdt-2BKXVhvAyaf4-2FRaqnH0-2BB658QrdAgwQ-3D-3D

Analysis

max time kernel
43s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://email.praxischool.com/wf/open?upn=1ScKDY-2FP1hooMRRSG2OtsG7Mk1xz-2FivjZ-2BTT0rwgttNm2TLM-2BS1LBuv4gF09uG-2BZ-2FQP07qbx1xoMnUlmBXvrndAKlPBov5z69JVsBBwtueERpWVeMGFMvooKndiZEsZMD5whrqd5Mgz9kWARQ7-2BZ-2BCmepgkvmzdgxbKLf6sgpxThqCZocKFaXhdt-2BKXVhvAyaf4-2FRaqnH0-2BB658QrdAgwQ-3D-3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1556	msedge.exe
1556	msedge.exe
1232	identity_helper.exe
1232	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 4456	1548	msedge.exe	43
PID 1548 wrote to memory of 4456	1548	msedge.exe	43
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 3436	1548	msedge.exe	84
PID 1548 wrote to memory of 1556	1548	msedge.exe	85
PID 1548 wrote to memory of 1556	1548	msedge.exe	85
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86
PID 1548 wrote to memory of 4716	1548	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://email.praxischool.com/wf/open?upn=1ScKDY-2FP1hooMRRSG2OtsG7Mk1xz-2FivjZ-2BTT0rwgttNm2TLM-2BS1LBuv4gF09uG-2BZ-2FQP07qbx1xoMnUlmBXvrndAKlPBov5z69JVsBBwtueERpWVeMGFMvooKndiZEsZMD5whrqd5Mgz9kWARQ7-2BZ-2BCmepgkvmzdgxbKLf6sgpxThqCZocKFaXhdt-2BKXVhvAyaf4-2FRaqnH0-2BB658QrdAgwQ-3D-3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9e1246f8,0x7ffe9e124708,0x7ffe9e124718
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,13191860102824624710,12407528677108677728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f7e75a88fe92d5147528c475c6908243

SHA1
7831682352cfdb17da7174cea8674e61e6fe7ff6

SHA256
4faebaa12ccf24466cb17632b61174043ca23e183a44b29e9e3f6cfc2ce3192d

SHA512
f210c56502e232b9e9b47c13eeb941a2ae7ee5b7b27742902172935e8986b23292151f21dd2d930d384b4dc74af032297b36947d1f8251ce5208cbdf93a56ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e3de1d4e8c043665a34c16e73a55cc1

SHA1
6122b9ae249e84c5d48c6e734c19f0cb97fd73a1

SHA256
dfc313dfbc6ea7f962ba70d32e5fa0b0cb85c81a6e71522d1048174a7d0b1a6d

SHA512
f4b80fc62c3b3d89cd2100d56ad245a9233a0f7ab4a3767dbc5ebd7350aa3a4bad8143375beab459e7f4778352d940e87a1de5ff333b09a694b586b84a073f1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
15c60d379338b245df49b1d278fd8640

SHA1
254f772ae32aa25874a798b61db38d8bade56ece

SHA256
28f86b9296a3a24d3a1ff8a9037395611b0361f2a1374b9da56265082164830e

SHA512
ab93f9ce7b12e40a954632b960badb1dec8f6f63ae95227f0d7cd4152e371d799b8485899ff1789b29f54ab8b269c88f2bdc145ff3f3364dbcde4a5fb6f3e0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
88d76733cde18621ed7567c0cfda2ab7

SHA1
41859bb156cfd94dbd7bd185567df2a9a5479998

SHA256
17a4767dee231bad758aa0b51bd7b7d8e6201c936e5b58aa76bbe5275c0c89cb

SHA512
e6555a48831412daf4af0a0039b47611428984d22ab0f851c62e68dfc9f91546542d0d68c759a988cc997b0fb1998e7aec10fa918869ed15742bfc4899f72f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b62e1b75-7e5a-46d8-8b03-7982b84772a4.tmp

Filesize
11KB

MD5
4ce9fdca6110237e622978c8c8560921

SHA1
a11cf131cfc453d355efa0c4a552c3b8394b4ad6

SHA256
5f67659585938a04e8bab718433762a96b3fdb53a5d017739514e9672d574e71

SHA512
d5e85572146402c313ae2cdeda1b33e000a896e919d945fad4d54b4a711d0432802d82c963643b21f398f5e61c6b663873c81e86a6d769c0c1c0385011d5069f

Download Submit