Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08-01-2024 08:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://qualitiesstopsallegiance.com
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
http://qualitiesstopsallegiance.com
Resource
win10v2004-20231215-en
General
-
Target
http://qualitiesstopsallegiance.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4472 msedge.exe 4472 msedge.exe 2080 msedge.exe 2080 msedge.exe 4464 identity_helper.exe 4464 identity_helper.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe 4448 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe 2080 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1860 2080 msedge.exe 34 PID 2080 wrote to memory of 1860 2080 msedge.exe 34 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 3288 2080 msedge.exe 90 PID 2080 wrote to memory of 4472 2080 msedge.exe 89 PID 2080 wrote to memory of 4472 2080 msedge.exe 89 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91 PID 2080 wrote to memory of 4500 2080 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://qualitiesstopsallegiance.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff9a40f46f8,0x7ff9a40f4708,0x7ff9a40f47182⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:82⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 /prefetch:82⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:12⤵PID:2284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4325848155542389191,1348028050253755563,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2356 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4448
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4708
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eb20b5930f48aa090358398afb25b683
SHA14892c8b72aa16c5b3f1b72811bf32b89f2d13392
SHA2562695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35
SHA512d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD58ad2fa2db733dd99080fed35d9edce9f
SHA17c1f2a72fe4752239e3ed4401b7f3e50aa950f55
SHA2568f1c9a2e700bb234114d28dbd95f82c96379678298fa9fa95acb422af69794fb
SHA5121212fe774d51b19e3260cbd017f3487c8ebf871301b07ed0c01be3242049a41de5980d3c01c8541b0e6ba64d2499a43c7e9fa7498c3497017e7a46faef29f587
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD5a14ec599b136c7ec309a67e4b9e345ca
SHA1c142e18eab0f5531c2fe2f6ac3b67de2a8d7d35c
SHA2565fc2896ee89671fc06e5aec7aefcf2f7a690d432ad7e8253c3a0ba2f80141076
SHA5125a85a325c10c9e65d3e05c33cc2c6b4703c796ff90fbbce17ce9072b4fc6ac0d4b237f844ac8c73d00f80cd99b0e2a6be34bae83bfbf6b7e2f18217cab78a4cb
-
Filesize
5KB
MD5bad27af0603a988b61a08146106d87a4
SHA17f40ab1cd7e9349a9fce3d1e8bfdbfd35427afda
SHA256d94851a1fbcc87c6e87bea6b2d63b1dc6ebe0f6ce514c52160af778a3bdada4c
SHA512e4013e16eff3a0ca547032f58f3e195075fa92d0553f4e6f3a335973dec414ea7b6548e419e7d799dd6dbeec1ca38a26e2ea54699dc16b60035fb05610d03ade
-
Filesize
5KB
MD533eeca6fef1b3c7f6d32f9439b8172f0
SHA19d240d92dea7dcf10820947c4f596ee6f4d42880
SHA25609ebe71a3392684a4de1477686f9369f175516f5dc1946e3fe47fed9881c4274
SHA51244b9cca51f60e65b99172a1fdadb8100f2cb5269b40f34f50d839942c18e343ae270dd04d3bc705842e3ec58a191ed14477907bf1c70351955a6f1981d084914
-
Filesize
24KB
MD52bbbdb35220e81614659f8e50e6b8a44
SHA17729a18e075646fb77eb7319e30d346552a6c9de
SHA25673f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd
SHA51259c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD55c62e60b8492951d9eeae40198adc57b
SHA16841139b006ca4231ce005dca6d5c4c939b1ac65
SHA256f50c1ee6992d122cd96e0c7dd0edb0a7073e8790656f9ced4a0517fb9bacdef9
SHA512986d2ca2b583fd304f5c6a9d9c60228dc0204277673f5483d6ca070c621ee807b7590e3c34edaffa55db904d86dd912bb315adb1918c2ce22f15eb7b1ca8ba5f