hxxp://mailto[:]swatrin@berlux[.]lu

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2023 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mailto:[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
4608	msedge.exe
4608	msedge.exe
3856	identity_helper.exe
3856	identity_helper.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3364	4608	msedge.exe	83
PID 4608 wrote to memory of 3364	4608	msedge.exe	83
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 3684	4608	msedge.exe	85
PID 4608 wrote to memory of 1144	4608	msedge.exe	86
PID 4608 wrote to memory of 1144	4608	msedge.exe	86
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87
PID 4608 wrote to memory of 2420	4608	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mailto:[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc406b46f8,0x7ffc406b4708,0x7ffc406b4718
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,173437938126420266,10307763937176763368,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
704946d21d0bc7be15a020ffd567ac52

SHA1
426a8122d262d172a9daaee676f0874b82d4c981

SHA256
976f1690f2175934e09f9c05dba1e8089fe1761eb11edc66a4f0ed9b411dd1c2

SHA512
4d49af02037ee3e44b272e23da4637e41530bfe71cdc7a088afe511ccb1af8b6cb56804902c85f8b40c3342cc36bde1d6cdabec5016ba2644011541e742d7e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7832667f3abf52246496a88d2ed16476

SHA1
ade8884c8efc6d2570d28cf575c4e60ee8eec525

SHA256
a172ef5dd6bf72f412c783f376d3aa3abf4d1f499c6c13df1d2cd76d88482d6e

SHA512
20e8a4bfda7d7cc2786e6ca0c12a29e32238d7934b8ce604c50396ea0f2af0a73e2f5076526f4b0b9537a766b332cca9d59a57ed49541c0024bfd7692de323b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb12500ee070fde6d427ea0de549f89f

SHA1
2a03666bb89671710a5e2710eadb7022b76be59f

SHA256
02a1a5f8ad81b116eb8973ad65dda3dbf577a64412ff3129a7fc4339ca24da0c

SHA512
a6f32afc666e8944f31b5f010d3b61bce706aeef8a2565bddf6677706d332b79c88041592f9a3cd98b1e88f461de68c82b206b2111b4d4f468c26e66dc6953a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d32f684965a084e0c67d3d1a0515571

SHA1
ba13492e033b0b80e80ef2bb3e42163d5a6335aa

SHA256
852be04528401c363b8caa57710dc9a23e89554d69990b463effdb3bdbc9f098

SHA512
0c5b471d4f86fb71663dca2d53eeff2bb276741c4ca16c8676e8a8187591360ffcf5bcb7dc9977fef1c09ab0168b40d0a53ab10b0ff7aadf614e48039a208b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ea82ddb3891c977cbc73bf302048282

SHA1
f1551e5b042425dde22ebf0d66f4fe0c5df975f6

SHA256
418796d7a64ad5d259c7a8aeb3589e36387075e322ed09e2265aa3674cc95590

SHA512
9b8e6677cac4817a390912ba184104fbed5459121c2b7ef33432d877220ae5c57f4ed0f0751c936b66d9dcb28dccb1b6e22788e3ebcba01ba2922a2c9799a3fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b8985e3d-267c-4f2a-9a25-27d3fd59f7b4.tmp

Filesize
10KB

MD5
dd4c349f433c9abb0097661d3708bdbc

SHA1
b113bb59c04fa88aaf9faf1f2e1be3afccea8114

SHA256
77be816ad4fe3c3ca49936b977e52304ddbe602a1bad2bd41c4fb8790d9b20e1

SHA512
57f33a6c8c1cf24d41917d86f9d9ff6df8d2c27db7768cf16a58aa03df4a4b32429a3770f3defb7ed96c63e9221d20d301f1e1187148ff8c4cb9c610690ad492

Download Submit