hxxp://ato-office-australia[.]com/

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2024 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ato-office-australia.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
4312	msedge.exe
4312	msedge.exe
3868	identity_helper.exe
3868	identity_helper.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1592	4312	msedge.exe	87
PID 4312 wrote to memory of 1592	4312	msedge.exe	87
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 2716	4312	msedge.exe	88
PID 4312 wrote to memory of 1044	4312	msedge.exe	89
PID 4312 wrote to memory of 1044	4312	msedge.exe	89
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90
PID 4312 wrote to memory of 3024	4312	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ato-office-australia.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8d9c746f8,0x7ff8d9c74708,0x7ff8d9c74718
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8836918214338578821,285158626336972214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
cd0c5d9bdc911c8d9de4ce325427bf71

SHA1
6ea9528185011fc1fdfb6984eaf42336a1329ad7

SHA256
86d99892f351778f442a23997aa97dbb7c185bfedff2b853d6fcea31e73c72ba

SHA512
7f26583a2ab824bc6e4477a27dfd73f0a6de5669aa6178c7bb28302cdb3ab243dd05166839e5f4a9bd98456187bbbacf9dd2e2acf0321d508c8a6140b035ebfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
898B

MD5
0370e9fba824324e31e77c9ecdfb54f6

SHA1
72a7bdd1071b3fc0a0ea9bd8aedcfe89deff06a7

SHA256
2fafef1727fc5b64d5b8f8c39ee2481cbb31a773bff1ee03a6e9c3735659a7e1

SHA512
45558b09b01bc091aeb66965daae2e264047b044b3c4c67184337505859710c47126a17e998b23803496ac2862ed69e26367f834c25906fe1eeb71c7a641ba96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
432918c46bdddca2a21cda88c26582b2

SHA1
4534e37b713e9db54d460a4ba6f804c1dd41ddf6

SHA256
b4ac5df4c06942470bef5f520f08386c67fa4feebf3e9bd3cbfefd5cbb116a3f

SHA512
1f60f1dbd5a2735a8ce5b5d0a4d1c24a2f8f334978476a2f62dcc0a4ef1352b622fdf7cded5eeacc102149e04600000b94c7ec46bd167bbd306e13ab7ab4bf9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c36431fd7af61d6e509ade4d1bce6086

SHA1
5a64bf2be0c60df9ced22c158d6f73215ea4e2da

SHA256
a39727762fad15fa55fd5b15e6e1fe448cf694f543c119275fb9823b7f7b876b

SHA512
3e5275f9c5b4cade4b5e9a48fa03af654f6a090789291a50fad5ae22974d5098a6581027f02c4325b1d03355f9b337f33af96aa1975c8bfa7f1909c8eac0f821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20e68e6108a179dbb0e6161b48b053c6

SHA1
58f1d024bc9042aea5898a8508c0bb8a5cff9f1c

SHA256
004c9365fdc74be9259ff27912c6e7ebf7f9f5f6d3204c9b2b0a9b20345ac5a9

SHA512
065179f8ec1ded55b66fa07ed3e752e8cc044fa0291db68228b470bd0532ea34169eddedd95c0976f6516be98eb835b5010d502ba3a2892edc6168dd97456f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b6cbb917d2173661d3db012f289079a3

SHA1
bb61f9cdeba0dc4da1bfdb6dede11f70d26a71aa

SHA256
40abe3c4235457ba963ebda3761f837100a39a48ec18efe20cae77b662ff8d43

SHA512
b6454d2d1788ff3556cf07b4d54204f53ad5a50d4cca9de22d078dfd7a320d6c2d0076ced16e910d1242ab6f91f6a22a2afd2eb4c5408708fd11c0fdcc8f2e8a

Download Submit