hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001mHxiWPO2kRYfp4gJGdrkn9LDtql7iGFu_bZwJIqnrAj3IwU9xDKrz_U77Rh5Atveb2W-ZkdK1tRtV7e_joKa2yd1kt5KkxVSjay0--mo-o0RqN3RoGdLlMQoqV0i_Ph9rUzra9-9wc0i86m85eEs1O4qxLJqWJj3&c=KHho0QuxpHD1CRSpD5en0wZT4I663dnHtjd3Kznp7BufwIg8Vdy2rA==&ch=VfaQB5G93dN8Q54PNby3_3yQ9JbB8sMiMRqV0DyaBMIX7dFMd7yCHg==&__=/qwer/lGkel/dG9ieUBmb2N1czFhc3NvY2lhdGVzLmNvbQ==

Analysis

max time kernel
75s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r20.rs6.net/tn.jsp?f=001mHxiWPO2kRYfp4gJGdrkn9LDtql7iGFu_bZwJIqnrAj3IwU9xDKrz_U77Rh5Atveb2W-ZkdK1tRtV7e_joKa2yd1kt5KkxVSjay0--mo-o0RqN3RoGdLlMQoqV0i_Ph9rUzra9-9wc0i86m85eEs1O4qxLJqWJj3&c=KHho0QuxpHD1CRSpD5en0wZT4I663dnHtjd3Kznp7BufwIg8Vdy2rA==&ch=VfaQB5G93dN8Q54PNby3_3yQ9JbB8sMiMRqV0DyaBMIX7dFMd7yCHg==&__=/qwer/lGkel/dG9ieUBmb2N1czFhc3NvY2lhdGVzLmNvbQ==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 928	4716	msedge.exe	72
PID 4716 wrote to memory of 928	4716	msedge.exe	72
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4916	4716	msedge.exe	88
PID 4716 wrote to memory of 4028	4716	msedge.exe	87
PID 4716 wrote to memory of 4028	4716	msedge.exe	87
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89
PID 4716 wrote to memory of 2624	4716	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://r20.rs6.net/tn.jsp?f=001mHxiWPO2kRYfp4gJGdrkn9LDtql7iGFu_bZwJIqnrAj3IwU9xDKrz_U77Rh5Atveb2W-ZkdK1tRtV7e_joKa2yd1kt5KkxVSjay0--mo-o0RqN3RoGdLlMQoqV0i_Ph9rUzra9-9wc0i86m85eEs1O4qxLJqWJj3&c=KHho0QuxpHD1CRSpD5en0wZT4I663dnHtjd3Kznp7BufwIg8Vdy2rA==&ch=VfaQB5G93dN8Q54PNby3_3yQ9JbB8sMiMRqV0DyaBMIX7dFMd7yCHg==&__=/qwer/lGkel/dG9ieUBmb2N1czFhc3NvY2lhdGVzLmNvbQ==
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9213046f8,0x7ff921304708,0x7ff921304718
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2117486395398248310,10003031485910278156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
56a119046a3d6228d041c372fbd76808

SHA1
25f6ac5c970efd9fddcd371ab9fff96d72647914

SHA256
ffb9cbcdb2a2f6928f6ee300a739eee87d5a8704f6c7362290be2f23ce7cea97

SHA512
8a58373d6f20a5191d2cc375c1fb1cc5d4e2e140537be52e901be9a2ae17429e738b2c40745905a9a1c28eb6a2b03cf8d3275583f84995b4d65513080c3f8e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
63c5742ce7d758d66da2d42be96fbf29

SHA1
ec227066c8c0e523f1eca1d86c7ded337419ab44

SHA256
0eb227253dace1373fdb4b77e311cf14f09a7f64b3d0c44faca86e4202cb45fe

SHA512
3423dbf58e21f851075aaae9bbaf1d3d73c8bf9b5727991803cb105e36a28028c0036263ecf3465b951df4286e180bde06d61de4dab91ba8d9ea21dca9cd03da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5054873c99caf3e6232a482ec3fc2ea1

SHA1
8f7162d67ef08d65707c43e20fe00f04754700bf

SHA256
fa50795ebdf47da673c42bc3ce11e91fd1fef849413b9747cf5b8b0b54877346

SHA512
caf6e54900cf0f54bdf84b838040f61097b2762b06059f4398fc9d956c16d7cf641980975e5eda5d9e4ab14fff8e495c18ca9aaedc481e36ca0b70b4e7c6844d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e0e10b853a453629b7a33f731e7e4faa

SHA1
9087a2cb1e6bf8b559cd4b910a3096a165085e40

SHA256
1ca21be4ee414e0d199c874710551f2bc01761200e36ce0d7582ebd6b210e398

SHA512
70676a904ff14344598c54c14fd8be9be799ed977b89679d3f1778ce610e79aed8e5560198ea9f13aecc4bc8613d987e20e96c900a345a7b1110c06cd5596308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
77acb485b0929ea91728c8e36aee14e6

SHA1
cda2fbf28027e0c375f1c08a169a61c8bec543ef

SHA256
fe1ae003dccb7ec0a5a1159c856b43514e198412380d07fe9e1e6de749095afa

SHA512
d3c6c431ce93ebaa689d98c958ba57470d86971c044598af0ae906b3884398a0c78de70231f1c02b56e37d8e5ae17cf745ef8d507ea9362b850a9faf76ec5566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e9e1fb05bef78edb5e74770511137073

SHA1
dd222696f2db8071828670aa9d7e489873befbf2

SHA256
3df3dfa6dea9ec2499f83129affabb12500879c31c8d80425d4796641721f142

SHA512
278c77a347db5a67dec770c7b631c2cbaa026515e7a6d549d1a86463e9e114352dd7b02e7cb508c3a6d9ee5ab591f7bc88d93db5366f86aae0ce793b9ffb067c

Download Submit