hxxp://fp2e7a[.]wpc[.]phicdn[.]net/

Analysis

max time kernel
265s
max time network
274s
platform
windows10-2004_x64
resource
win10v2004-20231020-de
resource tags

arch:x64arch:x86image:win10v2004-20231020-delocale:de-deos:windows10-2004-x64systemwindows
submitted
30/10/2023, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fp2e7a.wpc.phicdn.net/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
2104	msedge.exe
2104	msedge.exe
4540	identity_helper.exe
4540	identity_helper.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1364	2104	msedge.exe	88
PID 2104 wrote to memory of 1364	2104	msedge.exe	88
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 2492	2104	msedge.exe	89
PID 2104 wrote to memory of 4076	2104	msedge.exe	90
PID 2104 wrote to memory of 4076	2104	msedge.exe	90
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91
PID 2104 wrote to memory of 3916	2104	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fp2e7a.wpc.phicdn.net/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd041a46f8,0x7ffd041a4708,0x7ffd041a4718
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16644500924629545250,10108749845766265009,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4099cdbee01e5a1c631ebf49f8027923

SHA1
625ee1c10215d6a3d3d868f6e742d805111f2944

SHA256
701909ab9d12904a9a12cdbea1453816b8ce1b03d2f08b3ab0d41fbb3b5461c8

SHA512
66d4d7aa9c6956d845481e071a06905b3d3c88b1ff0f6b4229b6b07fa7ba7e1524d3a026a73aab7b4da5dd68d46878d71050b840cecfa9240af42519ae55ea12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca9aca330fc45951b0efb3d8eb459ff5

SHA1
652aaa9527b90b610e81098a20a12a87e6c6f1c5

SHA256
1a5e3af4417f94836c521a39015b2c1ff774277db2f64617110a2eb94d54d0aa

SHA512
a60f05870f565b85faaae2b1d91d4d33c130345ce9fe8342369865068b7e87ea7ba97913a648014476d4f4124ef9e75c795fa18ea8d06cff415bd0ff0c1e0bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a3ad83c31539c6991ad646232f424e91

SHA1
5135ed5e9a820e3b8cf34a1cd23cf79037dc6d16

SHA256
0f41f8ef26bd1a4baf4d770352d120e94f3af60b3e755e4818dcfae7b9b9aefb

SHA512
a6bc3c4a1926e2222ea3ad34a48b563a8da80193e521ff8ed543e87213059366994b8bafccf55327e91144cb0d09c0f45481d8de136a645229ac46bcec53e77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4b2f130bf35441e9bc3c591be7bb6670

SHA1
3ee7c43eaab355e83401fedbef5e94c1d3b9686d

SHA256
6fd8213028935afabc1f1a47f8a1aeb940d7d57bd637fae0486bc9bff4bf1135

SHA512
d1c0a452004656c69c5e54856acad7762b09bcf46acd7f0769cc6504c7587c7fe73c6587189ea09bf4ecc0117efb6e5ecce05b042ca715d624261850f2d606d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b64ee516b9e86aed7a807fb3c663c443

SHA1
4189225125daf770a67d3b54f5bba0b2fefdc155

SHA256
c108ca91e27353c3af36f3caf7f90f633c1c535eabedc4a93b833297eef05e64

SHA512
b7835ad2bb75b231a09dee4ca749866099a86ec466a6b7eadd79e92cd962306dd4e2f21899d53bcf0b468ec82a341db55ac6692e0130430f21ea1b128fe99b20

Download Submit