hxxp://www[.]azxy5kjw[.]com/events/

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://www.azxy5kjw.com/events/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2292	msedge.exe
2292	msedge.exe
4544	identity_helper.exe
4544	identity_helper.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2772	2292	msedge.exe	41
PID 2292 wrote to memory of 2772	2292	msedge.exe	41
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 5024	2292	msedge.exe	86
PID 2292 wrote to memory of 2308	2292	msedge.exe	87
PID 2292 wrote to memory of 2308	2292	msedge.exe	87
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89
PID 2292 wrote to memory of 620	2292	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.azxy5kjw.com/events/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ff9e46f8,0x7ff9ff9e4708,0x7ff9ff9e4718
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1071625429973351761,16006473238639017354,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
41941a2a3e5107501a310d4dfd73e5fc

SHA1
200ed2ee75f3e84448945edaa8bc046ac6dcd625

SHA256
b72d64bea30a50e96ed59fb2a9b9ca091a7cad4ff8dc99f5e3d9eb0504c57eff

SHA512
deb276ca495b1cafecd52f390b0fd0ed8f6dfaaac794291848585cbe1fa9c9aba7aca43f4a34eb8b669cddd6e0e8ded65e7d5455fdfa43b23f40105dfbe865eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
865B

MD5
7ddc476a3b8e33ce5c2f571b7f0223e3

SHA1
fd0ccbf39a41669dfcd0a59a6e261fab65a1a45b

SHA256
b137c93b5b634bd0b89c8782eb24a6a8357d90a93c66e7e938659ee22947b725

SHA512
4c81b652290d1762f6dfceaa758f2a57b70fe9c7fb3fe375b8e200a87a5af3e3aa40e694a564780ed1a65fdadf5abc4cdebb8dd713a0740e8760d41cb8b20a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
84e6885c702a9a058c38bf351b1b8d92

SHA1
aea74312e320f46faf9b6556badc0f933b0a63a5

SHA256
7e39147feb63f6146daec77bb0f1a40de825a138f082aa616f9212dcb61785d3

SHA512
748b136982e80e4c1ec7041abbc4a3ffa81df2fb976f5f9d2c7be89de64267b4303946943de175b797e4765855bec6ab982abf5c3fa207173aebaa2ee8c7f983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a8558ebc274398c0bed642cc1f996c3

SHA1
b1b9ee41435184e711ebb62efe7502d812b9b23b

SHA256
041ef68c84b16b8a4259f61c20842516903318bb98373e9bbe86c985261553d2

SHA512
4b9a5d73311d99c5bd5a566273b8026458707f3304486131aeb7649ecd74a972e681c997d7a92b13f088995b3f157d235047ad8f8b7ee1811f05ce92087a534f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b8abe9b2d273da395ec7c5c0f376f32

SHA1
d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec

SHA256
3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99

SHA512
3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
290060334d8ceab76ca8b094b381c6de

SHA1
a0763ccefc6f0e0f2ac5ca8a03df4c67791025f4

SHA256
87fb114897bbd32332a05cb00aff3d83ff94199db12acb4b37a874a38a770a94

SHA512
8e0c77092b13ac053ebd66dccc898dcf7671a2440eedfa436867de6b4d543fd13c529765c1a5ceacacda779142e6e4a1d2531cd11a676b41f3f1abeb32e78f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c55e7a4abf7dbccb5e99da59cc79ebcf

SHA1
f333e627200a428c31ff4136bb7ab533d2e866cf

SHA256
a2d3c3c3c44b74bc7ac05fc25e61148dad04e1d42f047dd1099659f87109e4dd

SHA512
6b6f204644bcbff5eb359fc963718cb6f915e7008a375a2004ddaa55550c6c716d51f6a9b0e1dc84a6c6a735871320daabc932b4878300f69f16161ee475ead8

Download Submit