hxxp://t[.]pr00[.]net/s/o?3sg[.]1bz70[.]0[.]zmyf

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://t.pr00.net/s/o?3sg.1bz70.0.zmyf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3192	msedge.exe
3192	msedge.exe
456	identity_helper.exe
456	identity_helper.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 2404	3192	msedge.exe	51
PID 3192 wrote to memory of 2404	3192	msedge.exe	51
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 1684	3192	msedge.exe	94
PID 3192 wrote to memory of 3172	3192	msedge.exe	93
PID 3192 wrote to memory of 3172	3192	msedge.exe	93
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91
PID 3192 wrote to memory of 3516	3192	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://t.pr00.net/s/o?3sg.1bz70.0.zmyf
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba95046f8,0x7ffba9504708,0x7ffba9504718
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3137937323841854649,18163146616446350027,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6bb821031d8aba2030c55c7dac61e408

SHA1
61448cf8263c94eb9ffa84e4250169fc60651bcc

SHA256
31f1262abcf43b33e02c1e70bf028152c40bd26ce13d665004e8e80eaddead81

SHA512
9d723d274b94b3e10184c545e471e073427879895cff33d7be6256e0979bd7935daafd6fe2e41447e325c3baa64411c41d84fcf4318aafa508bfa643a06e5311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c5465311ae3af6572166b5b0c81dafb

SHA1
39e59ca8a052a3097096792641d4d3dd3279f529

SHA256
e1a7e811f5047cf8660c66c5f45adc9912a5b2b2b4cd5ca10fef776cfc603afb

SHA512
fb5c20b7d5dd3908e30dd9ab866dbe682b5474b7d9cba4d92d9073dbe113e3cc1195c9bae1c7ad22a66d5bc608e1af260c54ecca46dfd5753bc1d0631363aae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f56bc7e0-f7aa-47bf-96bc-f2d9c698d974.tmp

Filesize
5KB

MD5
ee97d5b0d51d1d81422734eca156f13c

SHA1
2aa9dfc378e5468edee3daef027413184b908853

SHA256
2e8a928cf9dc3ffc5c5e569a549f36c459c396b7c2dfce22f7d0b7cf2dabf266

SHA512
e0153838d8f170329de141cea6d23f51a3df5e1c5bb6d40e2108bcd67317a28b5642ea11a188f75221f04e9bba965be8ddc9cc3808d0ee1cae0f98cdce1e0983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f1829a0d9c2190db29d99ca03539e34

SHA1
651d0436f28b82c944a1db7f47f1b247801f7a4b

SHA256
4d8de1950576d378dea3d50e0538832c962537fe043e9a1bd09429c5a0b4eacf

SHA512
5dad6ce29059cdfd06d64631c9e5cd25f482a757017a7870d7474b63592ba806fda0d6f879fedcb502465af065db3e02cdde2f4e98446f1fa2cc6b2694eff6f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d34ee21f75c8e805bc631ea3a6d88847

SHA1
d85fd2ee77669f4fe8291baa175bf25b2ea5aa39

SHA256
1a9b0febef8b1805e90c978d6fc657853aec97d414ee690882550911be91835d

SHA512
5736311c4049eeee4228131aabce6ad354445ccfa217fcda4da95c7d7e799007b61e114e4869ccbe152070882a82e3634506026f3032dc78ea8e9749cf350c31

Download Submit