hxxps://www[.]kefron[.]com/automated-accounts-payable/

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.kefron.com/automated-accounts-payable/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4492	msedge.exe
4492	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 3704	4492	msedge.exe	86
PID 4492 wrote to memory of 3704	4492	msedge.exe	86
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 3756	4492	msedge.exe	88
PID 4492 wrote to memory of 4264	4492	msedge.exe	89
PID 4492 wrote to memory of 4264	4492	msedge.exe	89
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90
PID 4492 wrote to memory of 4996	4492	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kefron.com/automated-accounts-payable/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7ef146f8,0x7fff7ef14708,0x7fff7ef14718
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1571259855223688768,8508709240404637565,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
78eacd9fdb7220e687cb41c0cd860d20

SHA1
5dfc8b0bbf85b8de382818995dfb432a2d9a4d40

SHA256
32428f5df6a262dbb7691693769e8af88d91dc88a653042d511459b90039fac5

SHA512
a8009a9172a4dae89d01e7f2787c0ca8627d8297e123aaae184781c81f8541b517f483ecc7a8804a8eefa2aa6018859d0dfb3fe0b0a8db2860dbfa6d464343e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5e94917aac1814235887e0f88d3f99fd

SHA1
89af5e384397ceaf5975711ac0958b27132cd232

SHA256
e3a54df5469c5f68358c862066230c61d584df9cedaa604b6083f074632cbbc7

SHA512
d64e34871a17dfd2311ab3121792de4b63ca2dd704177133e179bfe800d4f7c794eb7add135eb559c45cf4419e3dc3b8711856da72ae92586a98bbf4fc057a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
358801e9610cb0c69f793faa8a5ed9de

SHA1
2d6363bded5e510320820dc7915b9828befade1b

SHA256
a0e25ca4e0297ca3401e96645ccbd8f58f9ca0b80f28ff086c2f54600cb1ef9b

SHA512
626412763465fc9123352314f9e52d1c40f6119c8f91bd441e287e0ba6738507405af65196210431cf9c542135efee63414d5a82498e990189b0eb362e08b1b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87ce179235e1712125b7158c39ec0a80

SHA1
18936ebd7ca74f401fa68c9a4faf5d9eeefcfb7f

SHA256
3f26de8a7f3040a318759eda1fc3259a2cb2b753cbd4d5e4c1fe2e63be60822f

SHA512
f1fcc0bfb589bdf476c703e876b65f00e0bb6065ad2a7eaef57e8584fa8293f93210f26b97130b80b3863e0ac762f91ad3cb5416a900dd23405d302a1bee0565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5416583c3ec5125767b5b797f67ed24

SHA1
2428b8294259ce75ec61f15ba48a21cf2842aa53

SHA256
ee37a375c4a1f8a01de3812ca90d78b54f330f9331edd9a5a00f64f1e053a872

SHA512
1e81174ab07d12767b23d951a4272b5bc806a4486f659cb2fff5642412875a7e5dae30fd36183c6bfd29d9b9e11e8ddccb77d0915f49f840390258a5b627fe87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e05436aebb117e9919978ca32bbcefd9

SHA1
97b2af055317952ce42308ea69b82301320eb962

SHA256
cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f

SHA512
11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
90542446fe122cfa50646362a0fab381

SHA1
a4e5e9258d82c295c4fb60d43b5ed38769596b00

SHA256
b91a6a21b975aad6deab220a1e2ec4bc03e442540b102ffe1a6bcc5b5c28b2aa

SHA512
3a9ffb671c86c5bc69f4bf7ac24746b2ebeb2678d942c905ec0756554480bbbefbf1dae6452ffc7de36b2b63fa8ee5ad47f549a8053cfa9a179b00cb59de63df

Download Submit