hxxps://berafiltre[.]com/zr2/?97961091

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://berafiltre.com/zr2/?97961091

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3532	msedge.exe
3532	msedge.exe
3128	identity_helper.exe
3128	identity_helper.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 4220	3532	msedge.exe	24
PID 3532 wrote to memory of 4220	3532	msedge.exe	24
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 2300	3532	msedge.exe	89
PID 3532 wrote to memory of 3536	3532	msedge.exe	90
PID 3532 wrote to memory of 3536	3532	msedge.exe	90
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91
PID 3532 wrote to memory of 4176	3532	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://berafiltre.com/zr2/?97961091
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd70eb46f8,0x7ffd70eb4708,0x7ffd70eb4718
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3964644561897129328,15882685915687585180,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
7f3bb3030e5d8efb99042b6c088949e9

SHA1
8396c59600d032580871fec04dc5ee0968c7d9c7

SHA256
6914def5cf91b06f90e2e82a5155f4fb74d01b3917631dc08e566eaf31def984

SHA512
359b3810e74a378d0ef70c17973cd35a9336ea2e84aa9f6cb9271d849bf80edfa6767f8aae2d1c14b36f472ef8a87c4843689fd2423f110fd500913543bd6cab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a4dbecb5cbe8fb2b2ac2fdc793b70148

SHA1
230623cef983687663105f6b8b3bfef44e3371f0

SHA256
68109ed094fe1b7f791792f8b3b0944ad932dfe5916e3e9178c27c15a4893c67

SHA512
e8dfaf6fde4b1dac3a809cc44702dedecf593e7d01e7318bf12c0ea07d60b4b9ad6e9c615ae336e218b53273cfee70f1e34fd157e4a91e6a080415404f2bc631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1493dc62a17e2563b1810aad43c88a11

SHA1
7fb693e9ceb3682781777cbd67e37c3019f10a55

SHA256
48e6ffbb75abea47713aa9cf6f96c6b4ec213acaf7cc77fa127842ae314bce64

SHA512
76e3800cd3e3936c9979ee2481a376b1b2d9721b44123a624770b15167bf65b53f55bced7ea24ceb8152c4e1c9a9feab7066a376d6cf0512957eaf66527ab186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
29ee91385b85b9b5d609c54aa0ce5dfa

SHA1
7fd1ceb398daeb9fdac20b280c7848e472151cd3

SHA256
b66234bf8f0fa184e3d44f672decf40146e1a4d24d47c1425ac61ab75fcac44f

SHA512
2bbae0260494ddb41f3ad3f149a5cf827264305d6fa1e2e5c6fa25a16e9d14769c68797a0584dc02997234cbba77d6a256b33239878144d77b0f6cde3862d498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c2260e147bb15381941d4003f560620

SHA1
03961dc597cdfc6c6ecf9df1d9d374db25117c6c

SHA256
d9497e8a0b86db7636dc2fce11cff50b3fbc2851fd44b42938056d731faa9f1a

SHA512
da83b484ead25df50a21b1022405d815a1144783909d5f9a29f86cc65f8ad6089abc85beb465aa7376872f7138b75acfa853478f5a8eef986bd43fdb8e487a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b661fb1635d0df068711c1e91a5f6d95

SHA1
2a501335d620592eba630db103c1835cbc7bd6ed

SHA256
753a3c369f42a387b6d6da4d3bb32e2774f4dcbc158dbcd77237b2e0e999b8a0

SHA512
64eabff1364236cbb1d737783e4f518b1768c92b79e5b34880e26f1d2d9734a46b32eee21a967740369e5a965da865b8daf82fe8684c1b43e23e4285f5d46bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
bbb69f9b12ac4d13d8d8d1982a5663e8

SHA1
4fd95bb0bb6ec3871dcd39735b50112124bac8cd

SHA256
ac1e972b6593ffec2bde89b98fe91790428cb2f91b7718446e5853da82d31981

SHA512
0b19ab40e9a2f5817e7dbdac66f90baf13b088aa7424687c299433aeaf977c20149b4933e028f83ef362c015273214d6bfdd699e6dc8e06443efb3f33c947fcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c200bd39617a41b6077eef2b79e4bee7

SHA1
1d849060d49024c5cd20e9f59bb91b75122e84ca

SHA256
f79db83368db003c0ca2f2a19d70c6e35a05e53936605e357d75466a4ecbbddd

SHA512
1068c4eb8955217e4caa706edebbe3b0b2a02d0d6e8f6198085f524b9bb73b38fff4ada136e4e2322017f92eb2cda0b6c4f29aedc758fb924e271aca8baf8415

Download Submit