hxxp://tastethemagictogether[.]co[.]uk

Analysis

max time kernel
149s
max time network
151s
platform
windows10-1703_x64
resource
win10-20231215-ja
resource tags

arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
25/12/2023, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tastethemagictogether.co.uk

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\tastethemagictogether.co.	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tastethemagictogether.co.uk\ = "82"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d8b2bedf4937da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7a71a0f44937da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = dd2fd0b94937da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d448c0bf4937da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = fd499bd44937da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4808	EXCEL.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
492	MicrosoftEdgeCP.exe
492	MicrosoftEdgeCP.exe
492	MicrosoftEdgeCP.exe
492	MicrosoftEdgeCP.exe
492	MicrosoftEdgeCP.exe
492	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4868	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4868	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4868	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2724	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2724	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
640	MicrosoftEdge.exe
492	MicrosoftEdgeCP.exe
4868	MicrosoftEdgeCP.exe
492	MicrosoftEdgeCP.exe
4808	EXCEL.EXE
4808	EXCEL.EXE
4808	EXCEL.EXE
4808	EXCEL.EXE
4808	EXCEL.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 4804	492	MicrosoftEdgeCP.exe	78
PID 492 wrote to memory of 636	492	MicrosoftEdgeCP.exe	85
PID 492 wrote to memory of 636	492	MicrosoftEdgeCP.exe	85
PID 492 wrote to memory of 636	492	MicrosoftEdgeCP.exe	85
PID 492 wrote to memory of 636	492	MicrosoftEdgeCP.exe	85
PID 492 wrote to memory of 636	492	MicrosoftEdgeCP.exe	85
PID 492 wrote to memory of 636	492	MicrosoftEdgeCP.exe	85

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "http://tastethemagictogether.co.uk"
1⤵
PID:3404

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:640

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2944

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4808

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\Q8LQDH9E\tastethemagictogether.co[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BACJ7RJO\suggestions[1].ja-JP

Filesize
17KB

MD5
f0e8351230b562572b4b315a1a55004f

SHA1
1cc73361100ce15353f2571a03a5d5a364be87d2

SHA256
650de9892142b102c0cd1f9deca25f93d83c0bb8b5434580c77dd4214a82e1a5

SHA512
3d7dd1a72a000041fe308828c714ac48c463e0022cad3495296d0eb72a0fc85127b3c46cdc0015da25d41e9d22eba887980c301663f37ad86e7ccbc452934d46

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\G51A6F77\favicon-32x32[1].png

Filesize
3KB

MD5
0a63a29f5f5718c0416fde1f218554cc

SHA1
2477b6b9372ef74f8fd29cf91c35ac05f57cc95d

SHA256
fc51d458c601d0fade094d9f410e444a41f9598419d3c137644af31a67b3764c

SHA512
fc59373befac783103ea992b8e09a520b2dca36b724542a307900850f2f3f4dc4cd4ce4b76717ec17b327b1946d9f27936377572e6e40c0ec1895b8f51bade36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
386a42392fb982dc145c598e608bcce1

SHA1
288fc0bf610c83d354d9385125eeddde5351f2ad

SHA256
4dd17bad9306b0e98a7a06470577af76002b683b55f3cfcd5a568583bd037551

SHA512
9d09b27f1ef2359e51a77ad5c0a0347960443c88cb3f5eaa1eb852d95e5f60957854d27f919c5104bfe6fa4ba4537f5a0cfb25d68467482aa6b9a98c9dce68cf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
158b934f8f291ce340aa5c5f5daaf05f

SHA1
d817ff5e3d5fa9dc8a808b68218498e2852a7fa3

SHA256
e9a85e0134e393a614330ef12aadd1dec40a60f48446588c504a41cc0512254f

SHA512
dfde302d0f427dc48554ffaf7ff168246e7e2d9b18f70a1bcf62116b0397007bad809f766ae1a8e5765cc774d90585629154b9c1e09bc801b7732f89db0c65be

Download Submit
memory/640-0-0x0000023159320000-0x0000023159330000-memory.dmp

Filesize
64KB

Download
memory/640-16-0x0000023159700000-0x0000023159710000-memory.dmp

Filesize
64KB

Download
memory/640-35-0x00000231599D0000-0x00000231599D2000-memory.dmp

Filesize
8KB

Download
memory/640-185-0x0000023161140000-0x0000023161141000-memory.dmp

Filesize
4KB

Download
memory/640-187-0x0000023161150000-0x0000023161151000-memory.dmp

Filesize
4KB

Download
memory/4804-102-0x0000014D48920000-0x0000014D48A20000-memory.dmp

Filesize
1024KB

Download
memory/4804-201-0x0000014D48D30000-0x0000014D48D32000-memory.dmp

Filesize
8KB

Download
memory/4804-113-0x0000014D48EF0000-0x0000014D48EF2000-memory.dmp

Filesize
8KB

Download
memory/4804-119-0x0000014D49150000-0x0000014D49152000-memory.dmp

Filesize
8KB

Download
memory/4804-117-0x0000014D49030000-0x0000014D49032000-memory.dmp

Filesize
8KB

Download
memory/4804-136-0x0000014D48920000-0x0000014D48A20000-memory.dmp

Filesize
1024KB

Download
memory/4804-195-0x0000014D4C2F0000-0x0000014D4C2F2000-memory.dmp

Filesize
8KB

Download
memory/4804-86-0x0000014D481B0000-0x0000014D482B0000-memory.dmp

Filesize
1024KB

Download
memory/4804-204-0x0000014D48D50000-0x0000014D48D52000-memory.dmp

Filesize
8KB

Download
memory/4804-183-0x0000014D4C2C0000-0x0000014D4C2C2000-memory.dmp

Filesize
8KB

Download
memory/4804-68-0x0000014D376E0000-0x0000014D376E2000-memory.dmp

Filesize
8KB

Download
memory/4804-66-0x0000014D37620000-0x0000014D37622000-memory.dmp

Filesize
8KB

Download
memory/4804-63-0x0000014D364E0000-0x0000014D364E2000-memory.dmp

Filesize
8KB

Download
memory/4804-413-0x0000014532E30000-0x0000014532E32000-memory.dmp

Filesize
8KB

Download
memory/4808-243-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-257-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-240-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-237-0x00007FFA288E0000-0x00007FFA288F0000-memory.dmp

Filesize
64KB

Download
memory/4808-244-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-245-0x00007FFA25D90000-0x00007FFA25DA0000-memory.dmp

Filesize
64KB

Download
memory/4808-247-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-248-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-249-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-251-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-250-0x00007FFA25D90000-0x00007FFA25DA0000-memory.dmp

Filesize
64KB

Download
memory/4808-246-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-252-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-254-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-255-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-242-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-256-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-259-0x00007FFA671F0000-0x00007FFA6729E000-memory.dmp

Filesize
696KB

Download
memory/4808-258-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-253-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-261-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-260-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-262-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-264-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-265-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-263-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-410-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-411-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-238-0x00007FFA68850000-0x00007FFA68A2B000-memory.dmp

Filesize
1.9MB

Download
memory/4808-236-0x00007FFA288E0000-0x00007FFA288F0000-memory.dmp

Filesize
64KB

Download
memory/4808-235-0x00007FFA288E0000-0x00007FFA288F0000-memory.dmp

Filesize
64KB

Download
memory/4808-234-0x00007FFA288E0000-0x00007FFA288F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads