hxxp://amendbendoz[.]com

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2023 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://amendbendoz.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4680	msedge.exe
4680	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3388	4680	msedge.exe	86
PID 4680 wrote to memory of 3388	4680	msedge.exe	86
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 3656	4680	msedge.exe	88
PID 4680 wrote to memory of 4708	4680	msedge.exe	87
PID 4680 wrote to memory of 4708	4680	msedge.exe	87
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89
PID 4680 wrote to memory of 2756	4680	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://amendbendoz.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8170d46f8,0x7ff8170d4708,0x7ff8170d4718
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5727707500985292184,10560818293229940926,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
330c53ed8d8829bd4caf2c392a894f6b

SHA1
dc4f3eea00d78949be4aded712fcbfe85e6b06a5

SHA256
bbca8b0343812fb9db9b3c59655a18772c7c40bc77f497b89067a82d5e4ce8a5

SHA512
37674d84e4ea2079e8fe9bc45b0ea8fd93ffc8d206547835e4211046ad310ba3e5a397cf444b17a4322f9513cbd91bd92c0b106776b879cb0388ca9386ebd44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
5f43101fcfb604416a3e7f04b8896f7f

SHA1
810b86b78ef9ac7dd1eb86989aa689ee318c61c3

SHA256
9393f6b07e68e0db9bd87e30c1b16d3b7a59fdfa67b46c9a3a4d77c3ce76768d

SHA512
8bdd57170a214aeb58b9b58d6dda72ec9291dd9b41416c04a9e31ec45919c0c8963286e61186f92ede41318adbbc2d4d43fe3b05f085301dd2689d368cd5a047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b06e83e5f8e19470d09590e38b3abaa8

SHA1
7a60a389a748a61acc5b87ecee60cb771d42b607

SHA256
776082df9b730c09ed555037dc3f9aa04f414595c33766ccf4a2a7a9b16969cd

SHA512
6f5ae62eada8962527240ffb4a8113db5cd7adbf2b6674ce41abb97f20822f799ad2cb67b2225b04258f9a0b3e5578e0cca15b67939a7cf0f3b483555cc2e997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cd7711ec0be0fb646425a989fc740e7e

SHA1
22e06447f428386913ed58826426d228beaff2ae

SHA256
a30ed7a5e76089bafad71aa9b7979a7ff1308c35f306134c1b91ff7eccb54eb0

SHA512
57c3578fb9571a1bf6659151767273ddc9b8dacdb96966fbf96cf8029954178cc341f5d2b178125a3b0c4cbb1069387c7557cdadc9428a16bcdc60303aa22179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
642c1320fd78c859c77e459a2ce6b373

SHA1
9381494b4b82068a5ee6d144f93874c3c2e7a2ad

SHA256
a83b29b24ebf01b390239fc578d820ff596c2be395f86bb6f1b0868fca3dbef9

SHA512
891913c52311da6946a48c3034730b9e7c4c9ca1541fa477dadf8203b85ea4c8b7dd60b7c63eeea8b19716d71fc11777020a77a45270f2ab1e0109e2bc7ea083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7c530925adb0fb41b1a2aec7259565ff

SHA1
580c05447b1b920efdfe6651c5a3f96a0937e570

SHA256
82c2690ce2aff7ea641ce4d0b1b30056d9d3d8d8b43bc33d55225676cb4caabe

SHA512
136e58a823ed223be90bc8a8be2e95a10beb26616f023e0577af6a879d977158cfd5bf64e7b7539cde8c021be21a97dc55faa980c1e534290e5abe3f8ef18684

Download Submit