hxxp://vehiclesinctexas[.]com/

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2023 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://vehiclesinctexas.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
852	msedge.exe
852	msedge.exe
4196	identity_helper.exe
4196	identity_helper.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 3700	852	msedge.exe	39
PID 852 wrote to memory of 3700	852	msedge.exe	39
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 3740	852	msedge.exe	86
PID 852 wrote to memory of 532	852	msedge.exe	87
PID 852 wrote to memory of 532	852	msedge.exe	87
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88
PID 852 wrote to memory of 2936	852	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vehiclesinctexas.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe461d46f8,0x7ffe461d4708,0x7ffe461d4718
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9170014000909052591,14968591298270872200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
ee95b198ffc1296ff47ebf5b0b20864c

SHA1
d77e9b02d71d05eecfdcd63a8c0e00742d9917f4

SHA256
fae51e072c0fc9b86171cd297f58688483dafff885688f25a006903932ba21f0

SHA512
c7f09800f9247bf92e55ce549129213beceafda25e753e8ffb611bb871ac8afecfaa7f220d5a3c91367ef216413458945959a0c39cea55c1ce4e3ef04eca5b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d1098f1e0f3ffee88f7a5cce1e86ac72

SHA1
84de4e65f78c08108783b0070876e4d618b42eab

SHA256
5a37b0cf43b8eba84ac8dcc060ecc9f891f44cd13b8ff2405b976f161d073941

SHA512
a5f42fbfe7734422ddbd2f363bf6e0db2c1a13d00c7150caa8f0a4b5743a93fa8defa34e6203181d95d778b2d917a3a71174c4851999495b4c87e8e473916883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32709adb65ea951b8c45a032a1507fce

SHA1
c70c7b28c49031065e7ea55b8363f611fde76555

SHA256
99317f6025b784eb81d9ddc03415a0ebcf7e09105f8f4bad269eac0349a09a4d

SHA512
01b69166fda6ded2c7c802d9152e4a1e35c291e7ca36748adb18cf5c8e376081222edff6dd846e3b0afed684167758cfd7ccd09862abd14c1458b1a26e8c155d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7ec38d3ef43ae1504303d6c4808095f

SHA1
62ca8589516c0a9b1ba6f57b6a2dcf85ea00ba1d

SHA256
7e4a0cee7098e7f39a25660d80dcf38cdf52d9a134bfb5d05f5212f96a03c77b

SHA512
12ac7f4b32a655e4970745dc2111768aba0d462a575e6407ea6ae2b946c369b1931792a1a8ef7071df05d1741a40a83399671bf565a13be3798e85bcb05eb924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
df64bb1585501d6febb60dd356056fa2

SHA1
e048e821d55f9398b81a7f8ce775a471d4512757

SHA256
d66706f481115e0188d2a70eece793c023a6a302f48406e6f1695a79968d8b7c

SHA512
aed6dda76e48ab6298774f50c0496203e92a43ff47f77bd2057c9dd402a698e4d743cbeef5cefb8a896c9e967093cde6852c1171c6f47cad7fc8c9ffe6af598c

Download Submit