hxxp://pkgdef43t4[.]jokkertybeta67[.]repl[.]co/

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://pkgdef43t4.jokkertybeta67.repl.co/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
468	msedge.exe
468	msedge.exe
1504	identity_helper.exe
1504	identity_helper.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 1684	468	msedge.exe	82
PID 468 wrote to memory of 1684	468	msedge.exe	82
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 3416	468	msedge.exe	85
PID 468 wrote to memory of 2384	468	msedge.exe	86
PID 468 wrote to memory of 2384	468	msedge.exe	86
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87
PID 468 wrote to memory of 2292	468	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pkgdef43t4.jokkertybeta67.repl.co/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15cf46f8,0x7ffd15cf4708,0x7ffd15cf4718
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,15036906815704599816,9255042150003929252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\069db580-1bfe-49d2-ae13-044840400975.tmp

Filesize
10KB

MD5
85b2967917f137d0d62c9eb7f2ecd09b

SHA1
b6f69ca1ad90e4663566659ef0291f69a700f6aa

SHA256
b1b86417e516a64291da0f659eac6f5186f6d12d425a0d7d7bc7442088e5b61e

SHA512
29a4d4edbaed3a700336bb01993a35a40a406667af5d773be84dd146c3f7f08686a6220db411822cebb177e4d29b955756d8eb9111655c9261d73ea38e13cc22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
5db2a7e00e553c4a926d24f42bc27c5e

SHA1
1f9bc840ebf0df16c1e863d58c8e6253039d56c1

SHA256
4a4b8caa2c26bb211be078ad84600c0624eae7b740f899992fc5816205ed42e2

SHA512
8360eb02a170d1a5e776e2866299725cd45a75b218d5e963550815b27f1276fc1cffbf3803a834327c1ce7392bd8346968b31deff792521da795b4c7ce261a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
83469df154be4c0c4ec6644e55a0ed46

SHA1
49667d55e12a75a4cef80ba1f97ecae41c4917ca

SHA256
cae0bf43042e93eab09db8d29289e879825769284da2abdb062ab28ef40fb072

SHA512
374058fa0d81a4f295e73b7ee1b9d7b85e42b06612749afd69a97c2b5f19fdb5863463c2bfa3ac9b302cdf1492fc4a7e03842454ec61f19df3a768c262e6719a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f63b21ca6b22e87fb68788f0d9a2f7a

SHA1
e1be5c821245601b11164ce226087f6707c00df9

SHA256
3d7e011b478bd5c0991bd81820a947ec532035890fc17c3d64c22aac7a4bb722

SHA512
10ae135ecb1cfdb961205d2ab1b525f1b19a4cb15b1325d23f1b652549fb2a3f5b25c00be544065da19f5b43316a2ea77dcecb266ce0346d78206b0e01b41090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0284e9d086b6ba69e5542b5dd08864df

SHA1
5229a89f9dec99521dee57a1a9a2a0fc1042c638

SHA256
404acc9547a48581e40f1531d8e8e64aafa10ee6779a6697c77618f9b37dfbd1

SHA512
cdb9580ecdaeefa58074c01304952664ee912bceb043b40d90821eaa09ec52bb426becb0735134b3a0916db1feab4eb2bea52998ac25c956e1dd8b02cb184b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit