hxxp://142[.]251[.]214[.]131

Analysis

max time kernel
841s
max time network
849s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://142.251.214.131

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
888	msedge.exe
888	msedge.exe
3648	identity_helper.exe
3648	identity_helper.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 4704	888	msedge.exe	46
PID 888 wrote to memory of 4704	888	msedge.exe	46
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1116	888	msedge.exe	89
PID 888 wrote to memory of 1948	888	msedge.exe	88
PID 888 wrote to memory of 1948	888	msedge.exe	88
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90
PID 888 wrote to memory of 2304	888	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://142.251.214.131
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa98f846f8,0x7ffa98f84708,0x7ffa98f84718
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3888 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,10622733644512341188,9984040678216919416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5396 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2430f921ebfb431716d98779707a18a8

SHA1
a4296a634347c0c30b3e101fdd2a10d5a87746ba

SHA256
00f6f17a7fdfde9da965c8236df95a72c6698f36274a632908d22039a2a828d1

SHA512
8ceaae534e5558b6ef3f0db80527d8d79a1aeb369d3bca85d7e92da4ac5c9cad83e604e5f566e957cbf027192b1308c61098f7b493d5232efbc4a15082737a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
bcb8cefa3ddf324be4f8929f3bfbe784

SHA1
2ac601b8e47a6b58d1a75f1549ce0cfe8c6149cf

SHA256
c8b43f82ffe78367347320aae138939ddc249e76aa17ede000d418aed7f5ddb2

SHA512
6e9151891d96f2d0e983e625c4584d94f477d90d4f77d39dc7bd7358ded66958c2d15243435f7b27b1256414b8ebc32731d7c7518bede987a76b4c35023c3be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
da3631eaacf4554e5aab8c29ff4a1fec

SHA1
a8e4aa2b14e5d056064275dd987c9ea00ae03921

SHA256
e751d0dfe5631cd8af2dcdfd387a8d9d7698c988b14c650fabf40055b20d0ce1

SHA512
8028076e685b05f2797b6f50bd87646e5fe87c8a717c9a0adbf60512529111c6c05408f983c2abf54a448a15f300176b1024cc03096b96305fdc76c35b7333b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee3b40efcc803daf6fdf8450578004a0

SHA1
de16ade12a320de018986f711a099acaa6c006dc

SHA256
05d4b0d63f2dd5e63b995a2bf20ddb0408283e207c3ba238fbea6118247cfa3f

SHA512
20a36ee7404a6065f8573976aa0987fbc34de54163cda8a7678553f13801c303b76db06696f274ebd005bf427eb8366b6e9ee876c733da4e293d92b3ccffc85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3c5fc6ebc6b03f8265e23a8c2d9cbe49

SHA1
3c028ef1524e83aefa4d528ead514ec44ffa782f

SHA256
38bdae1a79c39208b8c14ec47b66ccb5f58d57a1585a8ce764d45128a1eb9890

SHA512
b02cd9f19c3559252d620dbec4bba950ed2290fbfcd81d71138c544209abf0e1b4f3886c31e048c360cd74196f68880c0f5ff02c05125e0cff92cf51dcf35532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f8044bf3216b10475ceaf26ec7052a4

SHA1
a02003ebcb3982f8f9384949dbc98fe9776d5c42

SHA256
cf5d35f67326efca7fd0c2120032e0d5e1194a3870d1a196758373103eb6d353

SHA512
97e819bb2732b7a9bb4569107296079f473aaaf5a5df22c7dd490239b0d0dfe29a89718f91f6f37b756db0480a0dfcbc859c3c408817495a73a7fa8489691e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
eebb87276d4d8c8e86399953f1fd5d76

SHA1
2c1b7f15617dad6c5621c1a4dcd4f9e85b50c969

SHA256
67b90d14705ba0d32de1a712d96cee5ff1ba058c11206bc892e11ae77f985bc8

SHA512
9e48898e2dab7bf7b0b23242a2379d04bd717a76c8d2362b413cbae2d29ef2e50ae9cc5c4521a6092e53e12e64a2576bb13afff815574204e722d48cf041dccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
32cdd561f62083f959674710a611eb1e

SHA1
77b8ba3c65cfff6ba5984cebae4faf24e367c881

SHA256
04fbffa34f557153567539c89a18da47cf1e496f513e566d02dfad27fce286df

SHA512
3df2c8ad922f00c8eb8c3b10d220273addbca9d9b102522e0b66ecba55de969c810cf4f03df6053d8a93e01ecca0f8290733246ca45916fe9bcd14e4ed7b6599

Download Submit