hxxps://bonowatch[.]com/psp/?61040251

Analysis

max time kernel
30s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bonowatch.com/psp/?61040251

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3048	msedge.exe
3048	msedge.exe
1360	identity_helper.exe
1360	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4872	3048	msedge.exe	88
PID 3048 wrote to memory of 4872	3048	msedge.exe	88
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 2540	3048	msedge.exe	90
PID 3048 wrote to memory of 3732	3048	msedge.exe	91
PID 3048 wrote to memory of 3732	3048	msedge.exe	91
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92
PID 3048 wrote to memory of 3928	3048	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bonowatch.com/psp/?61040251
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9ec8846f8,0x7ff9ec884708,0x7ff9ec884718
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6639346880966475105,5949789529292854470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:5416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_bonowatch.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cabe5ac516551ede82ae57cb0b54d6a1

SHA1
64dbf599b0a3eb2c7b0ff1e7e11962759a23a28e

SHA256
518c64f7d3f4c4ae102acd6d3b49ebb2f880e7409bb6ef3dc66ec4d3bcc29bd9

SHA512
98dfb48192f48c69cd2841f2f39246a1133f7fcb15247c8ce32568f30e63cacc25ce629645fe47d90f47aee602e06f9759edc5504b6826d559d2f212f5c700b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ae9d8ceba33e57756edf4507675d6e7

SHA1
b830f85de3318db6c3418b2913414c50f6ec78f8

SHA256
ae8cc7cc2eeaa32ae55a81b49c1cb554f656bbde19c095e1812a39c60e032f68

SHA512
913b9626158f2b881e03fa28af32cd108b8861fa25924073d691a36af62d55fe81a6433e044b351f7c441b75cddb8ac32ef6c09ded5150e10cb11ad45e06d1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b118c96507a5109296ec2740756b0f4

SHA1
1716b7108f18dbaecb70be3394da76476eaab0c6

SHA256
1e252cdb1cd5ba44cbff1972558580e035114b8ad472b09f983b18cf98130a53

SHA512
00247cb34964e6f17837bc2c0313e3691f87daf5297fb9d490e2116fd3853a29d44124ba807db41154ce012d449c25ce0920b542a645ff89791dedc90aa1c86b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e05436aebb117e9919978ca32bbcefd9

SHA1
97b2af055317952ce42308ea69b82301320eb962

SHA256
cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f

SHA512
11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
99B

MD5
8b169e728e2278c050f5c832ae8c92a4

SHA1
315de3e26fa597832be14e728918d883b9e5e0d1

SHA256
d849a1e24dded879b39d4f682594513e00191905e0b81a386fd7bf05a2a225a0

SHA512
954c267616c637254ae6a3bcfa9c2420eab40aa4453680a6ab1825ad6c01bac364d3eafd893c0d9015a2d3e1b5d7222e588ee01c33219151e43301ee3a80c6a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
35B

MD5
343859b4ad03856a60d076c8cd8f22c3

SHA1
7954a27de3329b4c5eefd4bdcb8450823881aad6

SHA256
8c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f

SHA512
58014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
de6e27a7bf5daa1e667acaf994295e36

SHA1
d1e4a32b0a5206d53fb2a751db8c14322ddb66b2

SHA256
3cd48fc2a2ef311ebf86bbc36ca14be700fc00b5f3169f39a2b53d9930b22b72

SHA512
8133be157698d6e84a35a628f8fa06f9cea5fbe6936df48f7de34b931604a58123f4733d548f2689dd75734093ea64a5cb3bad9b53789c5ba8efe9ab57896e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
900bbe4d1e3ebc10b0ed564daec9e788

SHA1
e7f254dfb048634e2f7f0fb738a2e874c71d292e

SHA256
db5f8c532331b46f4b3cb604d07851b6a3caa46a6fec5e0875bc999b9da4c31a

SHA512
0ca3488ebb63b3d78647365b67505d15f1663d0b8f4a6e7d8251e005f34035ec0e062d47d87bcdbab11bf6c42893e4197f0e28c36f4301f88f2f812b4bc027b3

Download Submit