hxxps://lorented[.]com/gf4/101123080

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2023, 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lorented.com/gf4/101123080

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
2040	msedge.exe
2040	msedge.exe
2232	identity_helper.exe
2232	identity_helper.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2920	2040	msedge.exe	39
PID 2040 wrote to memory of 2920	2040	msedge.exe	39
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 2228	2040	msedge.exe	90
PID 2040 wrote to memory of 4788	2040	msedge.exe	89
PID 2040 wrote to memory of 4788	2040	msedge.exe	89
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91
PID 2040 wrote to memory of 3984	2040	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lorented.com/gf4/101123080
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9a2946f8,0x7ffb9a294708,0x7ffb9a294718
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,10633644311439500067,653980373636221743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef2ab50a3d368243b8203ac219278a5d

SHA1
2d154d63c4371354ff607656a4d94bc3734658a9

SHA256
2e2faf2873e0b8d58788da8603acdd772642a396fff661c4e32f8a581362cbdf

SHA512
4533997bf4070f99306337b8ff553691d4cf1d1b53401628524ad4dc9d29bd0536a3f2df4ecdd0a8afa81b7f917f40524c9a1898b566ee499a358abc5c84b27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a350f373e956daf61c0880cee34c1bab

SHA1
50f5920b04155305e9a9b52a88f96442953e8b76

SHA256
db399497bc0c66d57917bd0388456828990b55343fae69918e112e853651c93a

SHA512
bdb78f1fe7428225b70ad7b2c4450041f9f38bd5e80d90542dc4cbce44bb3b538fdfc57100128a3eadb49abf772791f318a044988f3e7c5e12694c0d8c2e2077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8fe5c0700dbc7a67a5d0931a6bfea9c5

SHA1
56a80c7e59464ba5b55c42741841c059c28cf6e4

SHA256
3f1b344be0eaf1343066a546aec7e5410270c353f9fac451d078427cbad5b2a9

SHA512
a481beeae137fa5f2ac3807dd43f0460f9deef293ac1029a903e9f546f22fa0f4612862a16f7d77943ffb002a90f0d98f0cc3e18d1b4af7a907bf5bb0959f703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72f586748ff132f04aa6860ba0018af8

SHA1
ffba25e961bd0c2b4b4de189291a46f7f9023472

SHA256
77c0c0b40e0aafb753e3089d27710aa1be1702add46f79e83f77b50801093e98

SHA512
a9ac46b235dce9d6d4560e9e92c4fccf95e77025514920247b0bc6eda453e1c27e380a094694157d7848a0d1cb90f84066e174d2ab1a1d6e4e7dfcd3b26b17a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bf38e67347aea6d520cda5fde321a1e5

SHA1
0e7a8def4c923201d76b41dfa9918bb1052827ea

SHA256
0f0744f36e30e64949c41835aa5666f25c1ab4f3636d9247b8350fd8ad4f8025

SHA512
f62478dd4e38c6bef2bfc24f46caa03840613711e2b6fda2aad707df5cbd33b25af4fc3954521e203b981c4a10e5c8fd2520cabc16cdad858eed819b45a6f366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
df57a594bbce02a530bc94af8e7d48d4

SHA1
88ae9bb3f4676537f2480b2b2c13c1dbf766a150

SHA256
074af2bfcb80f26eaaa922f10847f50b3d0dc581500a6ad0424304b4a4ba1448

SHA512
c1eff3a3294a739dc8f3e7ba381c5375d1d78ce8ced12ab7a8f4993a8d22c90d56006803f64a1e4365ea5bbd63fcd3f4b2f68f453b785b3ba8c6a5b9ba7a70ce

Download Submit