hxxps://olfaprops[.]in/mnevery/

Analysis

max time kernel
194s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://olfaprops.in/mnevery/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4140	msedge.exe
4140	msedge.exe
4480	identity_helper.exe
4480	identity_helper.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4656	4140	msedge.exe	87
PID 4140 wrote to memory of 4656	4140	msedge.exe	87
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 3104	4140	msedge.exe	91
PID 4140 wrote to memory of 4400	4140	msedge.exe	90
PID 4140 wrote to memory of 4400	4140	msedge.exe	90
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93
PID 4140 wrote to memory of 2796	4140	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://olfaprops.in/mnevery/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6c8346f8,0x7ffd6c834708,0x7ffd6c834718
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5432423169650575283,3465219098790293085,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fa070c9c9ab8d902ee4f3342d217275f

SHA1
ac69818312a7eba53586295c5b04eefeb5c73903

SHA256
245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7

SHA512
df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\481b3dfb-4230-4522-b322-d0de4a6e3349.tmp

Filesize
24KB

MD5
917dedf44ae3675e549e7b7ffc2c8ccd

SHA1
b7604eb16f0366e698943afbcf0c070d197271c0

SHA256
9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37

SHA512
9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
728eeb72a10f5ec2464f0385d03ef1c9

SHA1
e2a3215caaf646c43d7d25f1dc837dc835c6acf7

SHA256
e4dc80a4bae8e3fed1f7dcc3b467271777dd4c649ceae5feb4db1e47c09525dc

SHA512
fd1a6c9dcc7041a8f52559739e3637556e065efe73014bb2710a1c57202bf718d35764f81b572aecec28fd29ff161f746fa90f951e62068beb2f8a52398154d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
258B

MD5
07b3659687ae2b4454cc085bbb1e2c3b

SHA1
e084f240bac61c5330dc4aa99022d127da90320a

SHA256
1440fc6136bc7a7a93d293751f8ba004833dd0ca7b67771785dc8a017729e328

SHA512
c6b5824453597a47b14c3505d6ac0077e9484d0c188b3a56e769b9c2a79431720da464e502a8cea51451ff951e8241271a19e6ebdcb7f125a28b979441cc2212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fda98a0d5b15d48a645bd269cd57e042

SHA1
11c91c653e9a7027cb681b31a23c702629dc6e3c

SHA256
4a9bfc410bae9015f4631b2106b50f6f22cd7f8638738b27244c426de9ac8db3

SHA512
20f55f96c523275d9250c9830545589b22cd7ab7310edb81a5774dd1e08d4f396617ed08aca5820dc281020b3a0b71fb65697f92d954bded4dffb0a9f2ab47a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c0da04e91bc24dac43c116e4fd44789

SHA1
85608db3a7628041d4137a30908ec25b23804c24

SHA256
58a68c5875d1c79a431096a2ed60e7371591d8f2ac0a7b77c8d110ba4309c300

SHA512
d5ef8701b5c38f76cf225afc743c957b74df831bb0e3e015f88eac29104c2da3ab40b8428a7c542fcc7f8a1ee1a50fa10cf87e506ece884052e2461950f91a3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6103b103a268762a42e6141701b0b85a

SHA1
036d9917366dd68680172e14940a9297cba00bb3

SHA256
f3cd1aa09021ed7f816ebea1adc1116fb0a97da1613084aa43688e0ae7becf99

SHA512
5c711414fa9162ebaa93ff6a9a8a65e4872d1624c7793a57dffd98963f3839198811ea34411fe0d7cd209c97b737228721f32545f62baacd1afb987e58a144cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7dd60cd1177bb9c58d8956b93c8519c3

SHA1
0a181a2f51707bdda8b0f02070d634000b97c6e2

SHA256
d4707c88f231c5c9056e95aab3f6bb49c875e1018649324f7d9ba1ff7e271be3

SHA512
68619b64ba55922718279f0e982ef00ae0c6c66c6246177f5a4fca4e12259aeccc2d273a20c510a99256301904804fcdfed2e4b04ab74ef9ddd36d415ccc0fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
40ed698edbdbf67d75e3b1650320e8a9

SHA1
82378b9d93964a57497932ac2b50b4782b9db89f

SHA256
0f851ccb4861c66073080d136ce6b3568b2ce97dfe55d4775915c28bc64cac9f

SHA512
569793df8de48f4216d31e0c79b3f6a1b130ef27e5b98569d07f7435c9d7c6e181c4c2a8e411ab7e24d126385c5eaf29a05e002e6f3c5065d499233e26d234dc

Download Submit