hxxps://professionalswebcheck[.]com/

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2023 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://professionalswebcheck.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2432	msedge.exe
2432	msedge.exe
4708	identity_helper.exe
4708	identity_helper.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4108	2432	msedge.exe	82
PID 2432 wrote to memory of 4108	2432	msedge.exe	82
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 1768	2432	msedge.exe	84
PID 2432 wrote to memory of 2012	2432	msedge.exe	85
PID 2432 wrote to memory of 2012	2432	msedge.exe	85
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87
PID 2432 wrote to memory of 4320	2432	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://professionalswebcheck.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa055c46f8,0x7ffa055c4708,0x7ffa055c4718
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,11087824035645680183,534683276013307959,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
193B

MD5
f16d149dd71dd2726adcfc4d0fe54e82

SHA1
ff41c49c4dbd4000b244615857e95392995008a7

SHA256
fae020c059c30aefc4bffddd41f4a5585d83e2a126887900ecea0e64da541089

SHA512
cd9113806bbb7acc67698ccec05b037a796a8468effd297fe8e5cd664cbed4d4bf61ccf8a01faf514fb023ccef3f0264f7d8c419ae68a2b25fea54b757bec208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63c4b2e09035f16ad755461393aa366f

SHA1
a55d278d9893e34274fa2554a2e512b4b3d9e205

SHA256
a9d8005195c23d756bcedd849814393748a23f8736cfe0af855452b77e428a46

SHA512
6d1a423fa52049ca0df3b164c123e198fc8dc2bb9cd09ab259d85eb18e675a8f7f408457b332585abf766f1961b35c89483d578fe76a41dede51d4253f52bae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04b051b7caf78c89e097ced9a272d44f

SHA1
0a678e29d6f7e6987d4911bde771d96e119a227f

SHA256
112e7c944255848a71785b254d1161ac8ee9bf0b5716bcac1ea918e81faa4f64

SHA512
4e6c6bdaf8f0e710a1fa0fc29e7ba33139d04f0ffc5c37669692c66abd8bcc43aad048da20aa8bea396935f5f021bb51997b8fc28fd6dc07feb50f083e740fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e929a7ca9d05832421439094900f235b

SHA1
b4df88da33b87635aadebd9c8173903bd59d25d7

SHA256
9856ea2f9fc38c9a77569b70793578b85d6aa0b662b09f63fdb0d5100a3979b0

SHA512
fb73e99001b4ea923ac87179d9f4e927f85a2d3e6b9716f88281b786ad6871e026bb35600dfa08cb60c2abed4a192f8ea7fde1ebb42e3e386fde682fed530b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9e6fbd69b71507a28922207ecc4964dd

SHA1
8bef1cdeae964e8770055bb1a2e38cc2dcc3818b

SHA256
01b213a8d2c74a1f5fec25e158788e95426e0044e0d3a350f90166be68e85aa3

SHA512
89bf636ba2f9f0e0214037f8a14159166c524e15d075071b63b9a02d8d3a6dfbecbaa845be31ae592fa676db1b2538c290bf40d8fee200bd7408def1bd90bc5f

Download Submit