hxxps://dstat[.]cc

max time kernel
408s
max time network
367s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2023, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dstat.cc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5104	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
8	msedge.exe
8	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 5004	8	msedge.exe	71
PID 8 wrote to memory of 5004	8	msedge.exe	71
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 888	8	msedge.exe	87
PID 8 wrote to memory of 5100	8	msedge.exe	86
PID 8 wrote to memory of 5100	8	msedge.exe	86
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88
PID 8 wrote to memory of 3172	8	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dstat.cc
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc72a46f8,0x7ffcc72a4708,0x7ffcc72a4718
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9084542753170311287,1562338953183682180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9084542753170311287,1562338953183682180,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9084542753170311287,1562338953183682180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9084542753170311287,1562338953183682180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9084542753170311287,1562338953183682180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5024
- C:\Windows\system32\PING.EXE
  ping -t 193.35.18.201
  2⤵
  - Runs ping.exe
  PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
1c9a3afde7d7d69470d8f7ed6a310350

SHA1
2b8dbaffb28e578f435b23cd252e748cea68ed67

SHA256
e04b73692f9d3b845ba4bfd3deaea55be137e4276956d5be9f5340cc5717f57c

SHA512
d3b53aba24f8a53c1c6631c25a6aabc66266c605a67561bd6f70e41e581ef659df29f4fe5d6691928f620bd75dba8feeadf349a19d6b83462a92ea3a640069d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
608B

MD5
06beaa4890b52fed3664dd18d5ff806c

SHA1
ba283827136db15e83ef663ae5b70ea179384e29

SHA256
69b7c39b59e0999b9161dc6d62a01cdf68e0552bb666ffc475429730e2f2ac69

SHA512
a207ab41ad0242549b95ba6b645ab9a3b811d02e7b3cfc28f8cdea135754cc34ddaefccc81df2c84c3da33ee95f26ec9f49fc79244b3ce786805e99a623b7914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc864f500e38a14d3add1c7463276f27

SHA1
cd6950bd140079557166587399e9825526adeb99

SHA256
fe2a01ed2dc00b03d784275e42e4951e3bc7d3956a497d5a4d422b506f363ada

SHA512
7c790ead6d6e8eddc3a662175ed312698c9988a7695292880eda8ac82860ea3c46e673a5b7aacf189089dc7033215fd1f17247bb35eff2805122cdc665997eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1dd949431d98b4d129896e5c7b5c3f4

SHA1
3ad287d1ec32bd1e24096ac0a27026c020324863

SHA256
e38919135281922cc7c7bf52acf62ca3cf466f590cf7620cacdf16b81eee5d5b

SHA512
e1b6916b54998e35fb274b8585c8404e31854847dd85917517e4a18c124463cb40b789524bdc6e98345f6b4fc5b89dbeaf27cafd89fabf5bb009b8ceb9be8598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b690c7643af8bf5f3a96b59e33522135

SHA1
204ca48a942ecba4d2f2ef844275c3f5905ed453

SHA256
4577c23a112c820b430e2b16d0283f4715b06f64164e1e5bf883034a7201c695

SHA512
f690f6f5cb19c2e7338feda4741c47b107e48e86db530829cff7e4a0737b813051d31625b1f3108bf8a2f496fad14767b6c255bc816a3e8a3bc43d4c2b63036d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
93f89c9cc49a6eb24e197df3d7e91510

SHA1
c2ff66c8b47479ec68ac8ec90be3f27534aca1e8

SHA256
ba56e95c594648d8b7171b931c2ec749315f9f0d1c9c7346dad53bceff613151

SHA512
b8f5090411f6f0eb61d9761bf8c874b375558a06771e7d05dab84b5af9b4885b02613ca1a6a8b864fc751130491455ad58d3cedfff438b7a8062ed9090d5c512

Download Submit