hxxp://bi-industriar-gt[.]sd68220[.]repl[.]co/

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2023 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bi-industriar-gt.sd68220.repl.co/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe
1072	msedge.exe
1072	msedge.exe
1848	identity_helper.exe
1848	identity_helper.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2288	1072	msedge.exe	85
PID 1072 wrote to memory of 2288	1072	msedge.exe	85
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 5072	1072	msedge.exe	87
PID 1072 wrote to memory of 2712	1072	msedge.exe	86
PID 1072 wrote to memory of 2712	1072	msedge.exe	86
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88
PID 1072 wrote to memory of 820	1072	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bi-industriar-gt.sd68220.repl.co/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe469646f8,0x7ffe46964708,0x7ffe46964718
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,1191719725086147681,5839953592485149290,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
abff9f85e5d031502e227bd452c46e86

SHA1
1e274d844e058e81e4d6a10df56f9556a2e99c5b

SHA256
e7612c79838e6b9524551d78c4883eb4b0489c70ac78900dade952f7df74e244

SHA512
3d1ffe280d7097e8d13eaf9e7387387d3702836b756304dc789250275071af33c30b7c727e47ee44685f5461a4c09bb52b78c229017fbcbe9b6b8604c4bf2042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
273B

MD5
cad84d4d6568d48ad4e8d0dcffa92fc2

SHA1
dd726b0fc9ede308af1dc9fd687a0f29c3641395

SHA256
008aa995df820cc0063b5b49d93f2dbf0a17dadd551de28eb1f3036e4ae541b1

SHA512
8cfd8938b744ec48cb5a3e44cef217b8a3a4f107ae4d93359bbe09ae2083ca15d83e8d260b89c752e97bae29eceb928c68e01ce5882a530536909e63fda2cd3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
009d5a4e5e65de39f0e9c8f438277c10

SHA1
216ffaec75931008f92addbb73ccedaefa3492cd

SHA256
357e3c1c797cf122fe3313387d8729545d1664e9b0754bfd04b3a477a85b074e

SHA512
6eca505e6c99197285187546b7c30f501ad5cc730fbcd7ccaa2f5cca6107a6b5cfd95033aa0586edde1cc8147898b11cdbf367109c2f659167681fa2ab5be9e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e84bc0450fe2938017e4512d3173e2ba

SHA1
c489cf04db88d7a4aa70877f8b1fa8d8fb963dbb

SHA256
252c99e46a16fb17ce8e535ade5d87e304a464379c1ba225fd2fde35d009fb46

SHA512
247a1dfad1ff348ee9c2ed3868d502701e0c27a581240cd309d97a596508e13b90a7d1ecc3b7560bf74ffeac27ab7d98008a5c5baa74041eb3da4dca05c9cfe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2799c10dd3f799d545e7229396b94e7

SHA1
5e7dd1d847210c660eaf2ca28a3d8372a88bb88f

SHA256
a3897de504820578e5af0d77351faada2ce96da717e2eb83e96a5bfc740db12c

SHA512
d201042993039c34a6a52d2965cf3dc0658a88f783ae0cb9fbbdaf5a6e8139484a835ce264a22318d45c7c512b502a9b6ff3a872223a7fa520e94bd324ab2e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
10f5b64000466c1e6da25fb5a0115924

SHA1
cb253bacf2b087c4040eb3c6a192924234f68639

SHA256
d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b

SHA512
8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
666327f8770f46c0403ef176a4085691

SHA1
ca73275fecea789105e970e94878031e77ba299f

SHA256
2bd674fc49157bf12662bb1aee39b85d257dbdbe06044324cd5f853ac5c0ca09

SHA512
16dce187ae9d5173b810a6cbd09c629777d033cfa41779f5c06dbe815960c2fb59adc9f30819ac073ab743b9f4f72f67ddc6c10665c24a269fdf15a1eb0b1d22

Download Submit