hxxp://45[.]81[.]39[.]74/nl/abn/

Analysis

max time kernel
595s
max time network
601s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://45.81.39.74/nl/abn/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
4104	msedge.exe
4104	msedge.exe
1064	identity_helper.exe
1064	identity_helper.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 2596	4104	msedge.exe	74
PID 4104 wrote to memory of 2596	4104	msedge.exe	74
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 4644	4104	msedge.exe	87
PID 4104 wrote to memory of 656	4104	msedge.exe	86
PID 4104 wrote to memory of 656	4104	msedge.exe	86
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88
PID 4104 wrote to memory of 4120	4104	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://45.81.39.74/nl/abn/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8108746f8,0x7ff810874708,0x7ff810874718
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4392313237591772916,2644396936397506634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4d3938f59a303b58486f625580c970ca

SHA1
947fa26ef1f29a9ede8d6963a7a244027f11c4a5

SHA256
796b5cbe26f3a31b6bd9eaa8072c85feef78648d6d43a35793f1ded8aeb4e4ab

SHA512
5b65b082446b1723ed9aa559d69919ef53c9e82702ddbad0ccaab500b7d7b531ed7bcdfe476fd0ad24d54d08263d1bc02e6711da31c4c09b60d3c76506b5c857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
497B

MD5
de99bc058f8b53ee95cbc78c30a941a3

SHA1
847fc5d4295522cf56b0758500ab846615a845f3

SHA256
403b182ce7a2f0878ec0ce952d287fb243f79ca92893586ba96943a84cc48f4c

SHA512
ce254993d4354e0d56c87578cd18cdd005358abb096d9c36286a19074e7241f19657d439df97836780f99f58f827631c2c3aeb541b2161d25a33ec55c982b22f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
811c9d2212160531a479a5ee00bb9774

SHA1
6fcd78e8a25d9297bccc2b583ca788cda6b896a1

SHA256
9682e1b2924b34bb13dda3954dda3227f4c17171dd2727eedc41c810486bfbed

SHA512
b0616a62e4f557f3ddd0f30e72bbe4e36d6d94d31ac20187dadb88b139b311a4be76c21562a0fbc705c6af3695797c51cac3bbaae53588931983fc9aa7a1117e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d8ad349cc78fda6585f2b7f0f3503015

SHA1
27932e15390ecd765ec778fe565f4b75d1e074ab

SHA256
9b137c8ccc51d2f76c7e85200de8dbc9c7e96fde9097238b588a33fbad1e7486

SHA512
0edc5474ae1a6c4316fd46a47a84c59442ace82996d1fb65c8527038adcc558f917a7fb92873b1879435ca6924d220a30bdb286a7c2e712db0a1c824f87653ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fbfd1838e75f49ae0f4b14fda4015c13

SHA1
16dbb96484444bc5d6f77ff3c8dfba13766c88c5

SHA256
ca2aebea3644ebcceba91ec39e5b4b825aca2167cc1a5c09a3fe9f1c440a00ad

SHA512
ea6ae63b8ab1680507515842c0be53f50d72196255ae51ec6ed8d6a516f200f00e5d9ffcc9ab454c70bb61d29f570488de0e37d7f3a79b9e4f13a7c58ae44e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9d706db94eab1fffcec287306f1e44b6

SHA1
9cd09fe1e57ebd72d0c80476b71ed4c22be66b42

SHA256
1572b277055c60a40acb20bbfdad2d8f74848be570609174acffea3ae4adb52d

SHA512
cfe2ba761b5c79008853cf91d11e21a2c6bdb7a10e38f44a5dd9fa9fee985593e384fb2df311f9334fa3f9e0f39396955f9504e0ec8a778f6d0f17763f386024

Download Submit