hxxps://www[.]y2mate[.]com/en855

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.y2mate.com/en855
Sample231005-ejwbbsae48

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
3856	msedge.exe
3856	msedge.exe
1488	identity_helper.exe
1488	identity_helper.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4316	3856	msedge.exe	27
PID 3856 wrote to memory of 4316	3856	msedge.exe	27
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 5000	3856	msedge.exe	89
PID 3856 wrote to memory of 4564	3856	msedge.exe	87
PID 3856 wrote to memory of 4564	3856	msedge.exe	87
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88
PID 3856 wrote to memory of 4488	3856	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.y2mate.com/en855
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b91746f8,0x7ff9b9174708,0x7ff9b9174718
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,16263642693031124919,17786507678573073924,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 6dd8eb1f6344043979de6a5399ccc946b1b5138b50df3dd87f93ec74f6e05cb0
MD5 a56957de7c4e2dd16b5243f013eb0d28
SHA1 7bd1cb7fce5853168f6919c8df1f5f032877dca2
SHA512 d6e95562929497039670a79c08d74958e15e9eefdb9265d0ab2b0f467438a1807ccd7ac152d60d025e1d56791c88179f68279fe68b4c5548a7608d3295bd53fe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 638B
SHA256 3004ed1f65fd4f201d7efd29e44f1df5bc23dd95324cc14cd620cbd6f50ee5e7
MD5 1d8285d1b0ba6ea9ea8507ee43aa9794
SHA1 d148a8552f9601ae527d0b22ac0051555d67fba7
SHA512 861bf5fc1f0c30775d1a96eafd87b3ecb003db8ea947917a28265b3c07287627acb7b7f2208acedeb8ae5fabd24df3ad00b5f9a1eb34cddd4838188f7f55f1d5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e9d6b7110e1f96178ca2cdeba4ce728381b3e82f39a20064391556ce1f8217ee
MD5 8952a44830906d934f79f1bfdfb8588c
SHA1 a11fcebf99de2ed98754dedd4335e657f30f209a
SHA512 db1d17e0269a853f9475d9dbf74f9882c510026f58d441a3c597a2c54e51b24ad859a7723a406717d4da7ad7e2d03efaf6c043404e6843436e2d828ac5012a1a
SSDEEP 96:nYfk8XpH1njkwpvWMoiVmdekYuY41nGWqWXv+UWQyV+VD7AiEwb:nAkiHpjkGWMLuY47qA+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cb962bc51e11de7f706b8946a7020a10c61310f42d32b27d862f075641349d28
MD5 7ff86638c88446f6459b42f34bca7bcb
SHA1 a6199847bfdec9519400789c18da514181ae3d80
SHA512 6ceae84ac884d7ee151627a39fe8e2a814d0c037303854737da820615b6fc49fc164338c48b055f24861aea029dab79b0135f9e048c6caa2d77aeb895eb98546
SSDEEP 96:nYtkxpH1nzkwpvWMoiVmdeHW7+UWQyV+VDCzia:nWkvHpzkGWMXa+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b
MD5 25ac77f8c7c7b76b93c8346e41b89a95
SHA1 5a8f769162bab0a75b1014fb8b94f9bb1fb7970a
SHA512 df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7
SSDEEP 768:nlxLKKeWwSIq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrJLlnzxDarU3up:nnUW/fu1ja0Ld3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 82a70e90403da1f1a8d89daf527cebefdd36c265eb0c2a9c2b81f8eee1aab2b8
MD5 3ecaee73ababe6977e1309e8bea430da
SHA1 2770c495aaf9e27342652a6831e047825fb82948
SHA512 3d98944fb3cbc80e4b1b1de5a44657d2265520e3b3dac443212f1a22efb90db0db0912a92bb227108735b6b96c5b76109bd9a364614ed7a4284cc9ed4df6039f
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCyde2RUFTrbbFWO9hX0KCs:N9iIxuERzA83h09RZxYX5yHFWO7Eftsx
MD5 SHA1 SHA512 SSDEEP

Submit Download