hxxps://ecovadis[.]com/

Analysis

max time kernel
59s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ecovadis.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

msedge.exemsedge.exe

pid process

3256 msedge.exe
3256 msedge.exe
2220 msedge.exe
2220 msedge.exe
2220 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

2220 msedge.exe
2220 msedge.exe

pid	process
3256	msedge.exe
3256	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2220 wrote to memory of 1380	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 1380	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 5020	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 3256	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 3256	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe
PID 2220 wrote to memory of 2964	2220	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ecovadis.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe076b46f8,0x7ffe076b4708,0x7ffe076b4718
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,4114836833221456164,17420567385670865376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,4114836833221456164,17420567385670865376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,4114836833221456164,17420567385670865376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4114836833221456164,17420567385670865376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4114836833221456164,17420567385670865376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9840af603cebff46041d0656372d22b5

SHA1
785cd2a5e9121fdea94328652d40928f596c9454

SHA256
f82fff9ddb9821c9e8a871d4f9be2396964b140bf42ad1485d9a3f95122efec5

SHA512
f3ad15f6f5f6f8917a314b3c1c88b453fee2632ed767aee687eb62fe7617de794f1049ace351dbdf64c2d2a740b61c892595d814583b1bbd753167b32deb86b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f3f761221afbdadd5f91e71e7823819

SHA1
e6067eef577b4ae23e344a614c13f4f5dc33d7de

SHA256
6d95a86eb8b073cabd8ab10c6dd9d201332432708cb38e5c2e19c2cfc0b75599

SHA512
1bbf30c13a10e0070ea28105e29e14d5d5983e7b952b003a1f883302e5d071811db440a43e7d7cd84c400b38e9f05ba94c7a982f1a86db503c56c0ce3af32540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab17a6bd1505deca073d87922d4fb9cb

SHA1
3abd99266b61c8fb7e00ce5798e4d9bdc60a9c58

SHA256
0a64ac9e2f02f15dc720af065d21fddc06c65a3b135729089d8d52550bfd1698

SHA512
f85839135b57554496ed9eefb8913eadd8ea1fc7d8b5e819884da61980f69676fbb675b7d0832bdb7d34622c744c5afc1eac21f98f612d99676246afa44b5190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
60ba051e67022237e231134590fc7b15

SHA1
4e3a070bd2367c47169af3332d73f8b551e6e568

SHA256
dcb2114ca12f05467d8b7869813f84e6249ca26e541375968a4f29bbf58e613b

SHA512
ee0b44daacb88c0549de03e3886664f7c0f3eef94f5ee908dc8ca40d83b4a6dedd0a4c4f5d8b74e569fc9679a73b02a3d4ec1421e02c9c6de987b9b556023ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
25ac77f8c7c7b76b93c8346e41b89a95

SHA1
5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

SHA256
8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

SHA512
df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
6a9d54e70e4c16e33efa8c694dbe7f87

SHA1
1a99278e414b4e47fba972587c73498dea823ac9

SHA256
529bc8293c69e3532476a7bc09a24a0334cd130873c6c1c7c8b4385239d0d159

SHA512
0a3d0c2c6c94b999e59f4134b770d2a2c37f4e874d1714f744e61748d9cec32993605372bb69ef433f06a0d7c7a9d4793c03c74cb4354b00f215b825f57d16dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588eae.TMP

Filesize
538B

MD5
38f4a2619dcf1ba614dc0bf3b853a541

SHA1
2ccfbcb049fcb6624b796cb371c2201ecc1a279a

SHA256
0a71ca9ebd7d228ae547789b18130afbf625bd14a3fafbb90fcffde93beac431

SHA512
b6684fa0b84cb1a535e7ccbd6fa7f4633a4a1c6e2d6f2aa1b0aec6577a318424a4dd5a220367429ff472dab9e97845119426f4320fcd15e795ede4861127bed2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dfae4665e554dbb98ba71d4e36f46f5d

SHA1
0b677137728e4d99d02880890491a187ec047969

SHA256
163b3c5338e2920bd229d1dcfb590913d83088ed9bdf0405ea0dbd2c25d805b3

SHA512
6c150e542a2c6d8748e6bf84fb9f9fc1a6df66b8620e4fcc7ab57bf5042c07e7da0f2ca1eb0b394ad74125d9402560c7079e2951c44ae770fa6a9ab15e877ccc

Download Submit
\??\pipe\LOCAL\crashpad_2220_EVADLFWCNVOYMBSH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit