hxxps://xps[.]customertocare[.]com/index/index/service/token/00c108d91a401092be99878645bfd7060633

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://xps.customertocare.com/index/index/service/token/00c108d91a401092be99878645bfd7060633

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
4420	msedge.exe
4420	msedge.exe
948	identity_helper.exe
948	identity_helper.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4200	4420	msedge.exe	42
PID 4420 wrote to memory of 4200	4420	msedge.exe	42
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 1128	4420	msedge.exe	88
PID 4420 wrote to memory of 5092	4420	msedge.exe	90
PID 4420 wrote to memory of 5092	4420	msedge.exe	90
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89
PID 4420 wrote to memory of 1996	4420	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://xps.customertocare.com/index/index/service/token/00c108d91a401092be99878645bfd7060633
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bc5246f8,0x7ff9bc524708,0x7ff9bc524718
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13832448464393331812,12761188377279901851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
1c1c243122432d17e281563407e972c5

SHA1
60f91b969c7d525fcca0be032d3d5a29083b5623

SHA256
d90eb3c8e409a02b88071fbef9616039ffbe3fcb7431b919c90dd34f0a8e157b

SHA512
862e29ce47c597574ea49c7dbcad17b56dc4f2179c480f79360856b0e4572935ef3661231bab34fa4300637b6eb8e3e71c2d8a4300809794d7ca390262398133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
479B

MD5
fdc1f449ebd9ed53b018e4a1401d356d

SHA1
e92a4ae544ef08f31761eeb94fabade3da042bd2

SHA256
4a991681f22b801f7628ba58f5ac4683e7ec15e1246b1a1dd8d27b82ec56fc84

SHA512
b50498f4c1f7af2f7f7827f87d7610a0972ce23d71a7afae0f90243f18dfb2e1b2042073481a8e352af754b30550b9a5726c147340b5f608342278f5a32f74d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a865acbf56b49af10c782e674296bb2

SHA1
81682b046f8fa31f6106f9d13ef6b8fb252f1c84

SHA256
2c2a3a783562f919550a057ae3229df0299c710ce05da4df9dcb23d2248e18ca

SHA512
a70e29a8b2a0c49b2f6cbed0d9acebefde46e2538906bfee1ce3ad964c0cf53693a5321c38f3eaea9786795987209c3247339833a5a30d5ae411513cde030ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1bfc75438a1646f74068eab772eebe80

SHA1
8068f2900de4c2beb6f07f3a085463189c9817d4

SHA256
9b5261225a411f59b206271012450f242af293f146c64f15b2a07ba765e4c861

SHA512
ce928e8cc0a07fc329f483998d96f29b4b66e34b8221a5ffa3d5a69fcecaeabce1433e9978935cef47469ea1e9ba5a0b183b945b302ef646f526c644b01c29e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d9fc018963799cee7c52cd213809e31f

SHA1
d0877dc2b6de4ded28218ea0a757efdee9b66af2

SHA256
6a92c2dc970b80c87d08c85e1540c5aa9f2c7b397cbba00a399f48ec5eba8798

SHA512
150dd377591792eada4b85cb5d7eb5c5dd62f53c6fd888e36e85f3ffd6af545a8be1f8da856d3d2d42780c384bb26d077bde45898b5e968a0e0e59cda0cd9b98

Download Submit