hxxp://myato-records[.]com

Analysis

max time kernel
155s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
02/01/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://myato-records.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
3488	msedge.exe
3488	msedge.exe
4300	msedge.exe
4300	msedge.exe
392	identity_helper.exe
392	identity_helper.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4968	3488	msedge.exe	79
PID 3488 wrote to memory of 4968	3488	msedge.exe	79
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 5056	3488	msedge.exe	81
PID 3488 wrote to memory of 1480	3488	msedge.exe	80
PID 3488 wrote to memory of 1480	3488	msedge.exe	80
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83
PID 3488 wrote to memory of 4424	3488	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://myato-records.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc72dd3cb8,0x7ffc72dd3cc8,0x7ffc72dd3cd8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,1548685150490310161,13110791258645323658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
92e040d7c1eeb7646714b53e4a95eb91

SHA1
4eaae5706d13b5f0ca9f2e4c994cfca63890dd7d

SHA256
5342d5a6f08451e0f1c54f8e3658dd91eeba2be804f3582ddf8d6a4e2d0c6468

SHA512
e5b4c0ee79b7536679bf2e54f865f91b4957d4f66e498a026b88a6c14a13163f897f54baa9da747c1523eaf20d29cca960b8949a08a7b0ab9b0bbe92478a34f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
e5a3a54d737427cf909bbbf7a6d25cc0

SHA1
ba5e3da3f8f920fbe88ac962c44a8919e36753c1

SHA256
085cdd4f51271ed1e43166b314a01718881ac13dc90f22af9427855f931ce8a4

SHA512
6050bc4cdf43b756b037d20b9459219f5de16d0c871ede9b2d763d25f9fa9717458b90e0a49a9f1b15b75455d3bee1f7e4d4546e87b2da18e67158cf4fd2d80c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d3093903cc4b36db0d73cf8d570509b1

SHA1
f46ed348f14f9eb6d56a5cc35023ab77dbed0226

SHA256
57dbb223e5f376317771850812085f32cd3c0a639236d24513c5f705095fd418

SHA512
0993aeffeaf0e91d0cc8c6a2641dd803c8c9c35387697600b40f9437b9b09408dea9dd260c50aa76f44c92c46657d2178b1cab7c58523f096a523e5f92556b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b31a2d970e467c963db3962d7746629

SHA1
541cb7e03d4c4a01b739422c33083c882d4cbed0

SHA256
dff631465c8dbb4c8085c47d661d3ede44a28e2bd99764f4fdbfb7e571caede3

SHA512
d2bf7b8f099a0ed1cc6fe609c18cd478ba5a940db2bf39b6e5d6dc6df05a96373e2007171450bd8cbb2f3191c72fb92681250aecd5296c59c512e390eeeb959f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
58e2b179dbb10d049fe23616966bfb2a

SHA1
b4f722b7e798fb6347837b51b05a4314a8219d84

SHA256
cb934e662ce5441a1fec40f63ddb8b828d7cf0f4a532712907064b377d2777c4

SHA512
ef3fbdd259151b0695369fae632106d190d2b9ac20b9854c5d2c23359ffde9469ea1736e7079264fd739ef3a214ac6ac8dbb9ab6c49184e5b5ebf9b8341c0c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2fac6472bef08a46501cdaa7fa7fc548

SHA1
d358d7cf793dacb220dcffbefe719571e4dfc764

SHA256
30f92b2e4c523c461faedcf5b3e217b82a544c9b1b9d4dbdf65522e274bf623b

SHA512
7118d1d04f97ba64ed91200f380dc7b2c88f4942a7f3a1800939b509126c9a0c83ca0710bf0071f4436442c447f23177dba2b2834a285d55da2f9378740a706d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
06d884966db175da553a62ce96ff0924

SHA1
03df646aa861437886f18dd85ac63d377c4f7821

SHA256
789cfb9384499fb5ddfa66af1c5ab02d95ba5356ad5c55f5aa9e623bc0c8569a

SHA512
ec650469d458935ed8bf066b92c512ccecd8e9f4d4709a485c026195e8225625f11840982b25e6fdfe9811b828ae419acec65f973c010399a3500f8a0816aaa7

Download Submit