hxxps://aureturndue-plan[.]cc/AuClickk/

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2023, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://aureturndue-plan.cc/AuClickk/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
2012	msedge.exe
2012	msedge.exe
3960	identity_helper.exe
3960	identity_helper.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4740	2012	msedge.exe	43
PID 2012 wrote to memory of 4740	2012	msedge.exe	43
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 1276	2012	msedge.exe	85
PID 2012 wrote to memory of 2932	2012	msedge.exe	86
PID 2012 wrote to memory of 2932	2012	msedge.exe	86
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87
PID 2012 wrote to memory of 3648	2012	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aureturndue-plan.cc/AuClickk/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed78b46f8,0x7ffed78b4708,0x7ffed78b4718
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14641216079276325039,5506090578458719056,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
e69590f86bd35be01ac40f382ad47773

SHA1
5c60facb40328785dd53ce581ef434e15afb760b

SHA256
7ab4c8a80df26d66d4ca725146dbc4b1b11ab5ec985a28fe179cdb2e4e759f7e

SHA512
102d633f5f3d1f716a3a6d93548c4d2509e2a5ec4a46561d292c9d1dc5e773376af7f9da6ae23d46506548dc92b31713cbc456f8ad06c395bde291c7240ee9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
872B

MD5
280549a831f2024196a122e6f9c2a282

SHA1
b441e58e4e9b4b6c26dbb2ec218a0a20c6286be8

SHA256
39b3c304c5daba2dbc3af4e213df4b57feff2e99660fcbbc0d948b6e735b8ab4

SHA512
ea8a12fe6dfcfd7f19a70105550915d0cef2c06b4468ed97d5e327c6ef0927a49ab012398002285ca5f745b6792a2440b6a141389343e63b88e46a82b6b1a440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e5cadca5ea141e41bb931ce9a332d70

SHA1
8b227130976042e50bed77f6f4223389a06bf9c0

SHA256
33fb1a5f1f096070420ba9df5aa30cdd8238ec0738518a793c49d4f72e6e9e54

SHA512
50cf5d3ff2a1ab297e8aea09d77d5eac8af9fad84580a0ba0331d0c73da8be8d5b7b3935ff693f46b9b156dc0fbb25596da9ef23065bf2eb8cf75eaec8aa87d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a5d377feb75fd1450d3b99d0bb0646d

SHA1
4a971e11954836e076772f66132362a62069f8e3

SHA256
728b21c19872a786ed0888b2f214b1d77ac0e97d548ee46ac91e97c48e85298c

SHA512
24d85d1ad3c56552b80c6c0a719eddc2d88e8f1a3efed84a4419cb0f6da5bfdcce38e92555a72c273bbfc598da43d112af8cd59a3966b296e4b249e6126d9543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e05436aebb117e9919978ca32bbcefd9

SHA1
97b2af055317952ce42308ea69b82301320eb962

SHA256
cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f

SHA512
11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7729f01c1d67a3a88b07d487ca871c06

SHA1
67e12369097ba7891da85fe788697990cb9eec88

SHA256
3e179666ebb26aa21298540df5a9d1d76d999591b0c90936eb1838dd83c9713f

SHA512
0c662d4b6c46a3871386854cea520cdc7fcfe5a52afff5351829e5ba0794d90ac0b96406eb70201dc9c7c5b2ec04b6926174612344d29341ef3d559591c01425

Download Submit