hxxps://unocoin[.]vip/#/homeen-US

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2023, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://unocoin.vip/#/homeen-US

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
660	msedge.exe
660	msedge.exe
2612	identity_helper.exe
2612	identity_helper.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 4804	660	msedge.exe	41
PID 660 wrote to memory of 4804	660	msedge.exe	41
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 1068	660	msedge.exe	86
PID 660 wrote to memory of 3164	660	msedge.exe	85
PID 660 wrote to memory of 3164	660	msedge.exe	85
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87
PID 660 wrote to memory of 224	660	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://unocoin.vip/#/homeen-US
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3b1746f8,0x7ffb3b174708,0x7ffb3b174718
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10838150748156535310,5861187598010644693,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea03d9602828b2d8f2b8817e89b06960

SHA1
80b3dad92c2312b04b2a4fae005e9cd0bf6d4e71

SHA256
e116c715af3149df19bd1b776adcac0979f08efc2568690dfa0d068dd8d6209c

SHA512
cfbc15f519e58578f2a25d6eb75784f64e836f93c78d72c4c1b06f4e47016135625ea5d8db1540a6aec3e1c60732d45f1e1f2ac6c007c552835fb4d71c474a08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
fdc07726222beb1fbc4142973c29f3aa

SHA1
2a528ad7801048712792865919ec84795f8cc8fb

SHA256
0f6e186655f691eaef29599756b60a694842d63fb1d844279e2cb3e55a73f758

SHA512
577050723eb6f4b01f04b21c6f6268245266beedceac1e467add283e5471a186d0fc2ebf48e4a703c813daefcd6e4296b0172099271b774c3dceed140132ec34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
456B

MD5
406b798b27c59968f3b52caa9406df3e

SHA1
f2a41c4e982e30616ef7dacc789a4ac209130bc3

SHA256
ea2d57e06bcc237ac0e0fd4182d2fa3bc3c9d3b356b27eb2ac2a61204da750e7

SHA512
8ea8f77ab955b1f1cc8f8bdb5e21d9dcb26c299c0e2808b3d00a69b00fa0223215e9169a2668293db30f4a474852a7ebf72ef5250e5128009d9af35c3213cb2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
47f18ed3eef514f8b9495a67298fb8bd

SHA1
6da5cea6e723ab0454c2bc4fa85f28e74da8582f

SHA256
432e4e93ac9a8eaf7187d91f2c550dca3023b2ff4a0178bac4efdbfbb1bd1a79

SHA512
32e22047aaf7737a8a9282d48b040d2d7e6f8e0556b89a99023526fc25a2822df3e0fd1d301bc756697f00dca970900ca834483b0394653d6408cd06a342e731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4277ba8dad789354cf8db0d0547fb4d9

SHA1
018aa031b12f1da9f26df14ae8c83efdd7e95da5

SHA256
fe825ecf970c91a605572cad801cfd4e8f68467818ea12374e8094d06d23751a

SHA512
a68a3003e49cf4ce6d94df3758c7554f6f27896d4a963e93afa750bfd70253f49262b97bd8c981bc3262cafa43e51334cbae7361e6c130de3bf97b548621f121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5932e367fa02188254b322df37cbffb5

SHA1
9014c7a88235332acc6050e792f5160a9fa8332e

SHA256
22cce4965574bd8fa8532368d69dd24dc2106bbbf2a45b6e6a7c536a9d87402c

SHA512
40a05fca3e1e6ea8c1c2a3ab9865e1c8a032d53d51e21b92cf2263e7a8cf4b88208939a3f0fb327b2dd694c0f89f6a1291a162415b9be846934623780f6d8f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
112d8b007015af1995bfee6e486b3893

SHA1
16942580f469bf6d0039d45368c81d14a66c24f4

SHA256
d6f108dc7386014bc38c0e0dfda3cb26932f57171ae1c2101b4dcbe0b595d5ca

SHA512
3c168e658518f91e45e2470d6a41ee0b403be345623ea3d5b6a0b546e819d34e6dbda9aaa3f37e1bad95347750a71422329a5495d0775858ed7551048174d0ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
773eac9f3348abeab9f8403f2382d85c

SHA1
0dfe5d7a4ac6d46eab02f62f01d531dbc1b5061d

SHA256
513245729b9964af4a78cfb4faddb38840cb6339b9c58f51de71ccd732c8d05d

SHA512
4038db71048350a30cf4d763dab87ef1cbd65ad5ac0aa6399623861d01757873efb5e38275a261e5e04d6420aa25adde6f5f816bfdeb4a7131a3bd966b26ba3a

Download Submit