hxxp://142[.]250[.]189[.]228

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://142.250.189.228

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
1532	msedge.exe
1532	msedge.exe
1480	identity_helper.exe
1480	identity_helper.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 4016	1532	msedge.exe	36
PID 1532 wrote to memory of 4016	1532	msedge.exe	36
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 3040	1532	msedge.exe	88
PID 1532 wrote to memory of 2152	1532	msedge.exe	87
PID 1532 wrote to memory of 2152	1532	msedge.exe	87
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89
PID 1532 wrote to memory of 1428	1532	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://142.250.189.228
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe46b946f8,0x7ffe46b94708,0x7ffe46b94718
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8032372591183285507,2162303121275594421,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
0ef7e9443d38fa1f63e63db328b54561

SHA1
6fa92090d9b5d38a1ebdcad175bf8f998b7dc05a

SHA256
de243b05f0e472107d5981ab70d3979346cc2615e9cb08aa4155929a9d691030

SHA512
d04ac52661c8970debc376398e78c87c4a475dad5b91931c994a386c614aabebcb21f04c76ac378f2d120ae3ddb09cd814d28f8beaeb6adf10c3a209756a3a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fbac0629c10136ee363ac7e82d1ad775

SHA1
8fe922cf1bbfdab7ad00090d1345b04ba6a0e535

SHA256
1583c51de94277a8db56eb9a47208debfaccfca6f6031de988659fd685504ba7

SHA512
1c40dccd641763d7a5ec0dedf633ebe69b4082a93dcf3f946dc3db334df956e6e5938a01512e819e42c63599ca28b2b09b25faf2ac8f9ce797c349a8c316f7ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b57012e5d5b2a7d796df963e08589d6d

SHA1
085e125ae12982a6cbd1e142dd5e3d1266f2ba47

SHA256
bc01ad3b2068014c12e357c9f04c40bdab5c5d56e47d37ad5768208ebdf7cac4

SHA512
1cf18ce464e8704c38f256d6f43b4fa50b1aabc408585bbde844b3932539fbc125ff0c1b40e30a01055cc11490c0c0b2ed3d67dfcb3e3f0010f7a5fa39992b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c400de00fc96b99ebf65bf949136845

SHA1
bc3db16429d4a671f77665e5c938c46361b14681

SHA256
f01929586893772da946b6ec1e696d5596328e62bd8dc2a1317817ac58567c45

SHA512
9cdb348cbc64a8a1136daddde16bcf09d32ddfdc633c5ce87af2e3c987f2debde9ec46cc7ae79946ba248d1766242268ef945a0d2fb4fe6a61e39e039c4f4864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bbf910de61e9207c4156e1b14d51bc31

SHA1
5a8de89e10a06d285a83733a13d8d26a291e31f7

SHA256
bc35e1f3a0342f61ca2468d1d1041ca0fa90e3f244963d16ea230771c2733909

SHA512
e750a30933f58fa9b440c8dce7d49521416b1c00d79788778a2c4bd726c310c3124477711ba5a65dbdf2d93007bda50c7afa7a04ba8b845fec482aa9aac8bee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ff99ad68c36fb573d23ab376b600f5b3

SHA1
a6462bacf2bd61b5bf95bbf65897c840faa09481

SHA256
e1155d52b71810b7eb23353e63bf58934b9e2e559c4ff0bad52f45ecd3ce494c

SHA512
90c78fc9ec648819f1253b13047e456775f451e952ce327e5cc9faa0a4da0523f63946456c2df0fb261f4c1ce9016961e29a516500a803498043611068e5ed49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c5fce1e8c692999142f6a4c7ce1b2bc4

SHA1
c6281e8905e8588fbe917f599ee39ae334112c22

SHA256
09993749e3a30de700c88df86b94ff5659e4a453f21a8bc0bd7f9ceee8e3b220

SHA512
046b8fbc0ef76286fab60a72dfc7063330ce19a1775c3a5c15113a26a7fa5b4af91df90d4fc8ff20cfd9bb23d453cc4ad7427bfa8a0c93bd2415bcd958715866

Download Submit