hxxps://virginmedia[.]workplace[.]com/nd/?login_alerts%2Fstart%2F&fbid=632626502378416&s=e&aref=1696601371537164&medium=email&mid=6070c807d6c3aG5b031d2751b3G6070cca136f0cG2bf&n_mcassy[.]phipli%40virginmediao2[.]co[.]uk&rms=v2&irms=true

Analysis

max time kernel
33s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2023 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://virginmedia.workplace.com/nd/?login_alerts%2Fstart%2F&fbid=632626502378416&s=e&aref=1696601371537164&medium=email&mid=6070c807d6c3aG5b031d2751b3G6070cca136f0cG2bf&n_mcassy.phipli%40virginmediao2.co.uk&rms=v2&irms=true

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
2160	msedge.exe
2160	msedge.exe
4184	identity_helper.exe
4184	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3868	2160	msedge.exe	85
PID 2160 wrote to memory of 3868	2160	msedge.exe	85
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 3836	2160	msedge.exe	87
PID 2160 wrote to memory of 4020	2160	msedge.exe	86
PID 2160 wrote to memory of 4020	2160	msedge.exe	86
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88
PID 2160 wrote to memory of 2820	2160	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://virginmedia.workplace.com/nd/?login_alerts%2Fstart%2F&fbid=632626502378416&s=e&aref=1696601371537164&medium=email&mid=6070c807d6c3aG5b031d2751b3G6070cca136f0cG2bf&n_mcassy.phipli%40virginmediao2.co.uk&rms=v2&irms=true
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff9119946f8,0x7ff911994708,0x7ff911994718
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,5967426577440596265,15284087570382025621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
60543a425ca57d37576d54cd43840ae6

SHA1
08457cabc3ac189c5d5520beb6fe7ed518e89fb9

SHA256
d8bab0cbd7ddfd2503f507b99b3dce8e4524073c334e4b5ff4d70b873686b0be

SHA512
039e0d75569f3d130fdba1548dcf3df9d4924fc2574b1c9fde4b3ba0e088c384284d1ffae9c2c8fd47fd87be9537c02ca488e2e5298269fb0792656fe025dee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b822ed866a80f086952eac72d88aa771

SHA1
b2f4cd9f1df5eb8e5c75d2c26c2d58fc65d45708

SHA256
fe280cb0f20fa631dc2045107a49572d20c2b6eb16c59dc825bf8767f7a9897b

SHA512
a989de7d82e79fea5f5b5377fca81729e44746ba0b57c4c556782bb2ed2ff067ec5180263d6e185292279b62688a24ac95f3b5bfe3da781baf1601c40bf55aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
98a1ac9740c908b5f34dc499d62533c9

SHA1
ec8a95a3c52e40faf5f2a03c4cc980ac53454536

SHA256
d3b9a492fca87f7457a98970cf7fe95f8a89fb5bde506f4a6af9c5bc19a50aec

SHA512
a56b89ff615e182d1c3e4416bd2be06259a776acffa25ab0c26be76585cfa039f1c0126579dc7284729a6a128974d05c9f1158424e29ca58cfdc45463a6996e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
4959de9d33c56ae85625192db9ad9ed8

SHA1
67afcbcba08117f6b7a5e8a3638d69a913d6fe2e

SHA256
92fe469116a3b62df9b562a5dae27999e3539ea4d5f4552086e281c567522382

SHA512
6e78db2df3771877202f5341c9c58a51fd3063c93a77d53021a4bf70e0900b1d44d6b910807075845c85f24ad758fbf1989051dd6807f5128e2a318c839bea99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b805.TMP

Filesize
704B

MD5
e97adc39e8c771cd94f7247df564df02

SHA1
41c1075f44b179122c14d87f5409e4b984eb1c6e

SHA256
f96f06287002d7485ba7e526b8f680de7a11ff9eaacfab08af76179f7f6fab39

SHA512
24de88783a8fc27c60e2dffd57a363ef9f0b10c7f1045095a2a481e058b6cfefadf5fe82d6cac020c25fad0f10278b861bddc276b89b59b41eba98f0a51fca09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
58b67f52915efca0dfb0b58d9fd16472

SHA1
4b86273ab35ec836b441d0fce9c38050bbccb8b3

SHA256
eb0df3e8e1cf4a2515634979126dcb6549d0d76204199c965c97020705e1ce28

SHA512
ee7ad888053a7a3279285038f7d713260fa232029303d3cc6120fb7368d343869771bd83770d48aab0596591bab85b1ade97cd8f3822524c45f373eeb3b7df26

Download Submit