hxxps://d1d4d04e-b929-43a7-9078-3a4ddd26b7f6-00-aprzcarhdxsh[.]janeway[.]replit[.]dev/

Analysis

max time kernel
282s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://d1d4d04e-b929-43a7-9078-3a4ddd26b7f6-00-aprzcarhdxsh.janeway.replit.dev/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3212	msedge.exe
3212	msedge.exe
3612	identity_helper.exe
3612	identity_helper.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3888	3212	msedge.exe	61
PID 3212 wrote to memory of 3888	3212	msedge.exe	61
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 2268	3212	msedge.exe	90
PID 3212 wrote to memory of 3796	3212	msedge.exe	91
PID 3212 wrote to memory of 3796	3212	msedge.exe	91
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92
PID 3212 wrote to memory of 1148	3212	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://d1d4d04e-b929-43a7-9078-3a4ddd26b7f6-00-aprzcarhdxsh.janeway.replit.dev/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffed2eb46f8,0x7ffed2eb4708,0x7ffed2eb4718
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14507244817895676941,9196105643530879783,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
505B

MD5
fa83a3a4c24b473ce750b62eb7ea2d4e

SHA1
9b30067928a3a3e73c241bfcf579d30569a75f53

SHA256
a10d3bdc17e6d254495e0ad63cfc1c919ef3e2c6d5d2ea5c46412e0869aed372

SHA512
273c16cb0a3114e94019006e1fb936daba30dd06c89a1a65a1922e0356cf01d802401e068b2b6ef68f4c5accdf60c59ae613e5548787e2a4f5e7384d07fb01d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
626B

MD5
c220419665dd09fa89c3112f7eb96f01

SHA1
586d45df6e686115ac66844d95cc8dd15b7cd534

SHA256
712fa9000e808fed0c35d46f2752f9aaaff95cc9d922a43b6a7b6e58634917e2

SHA512
311e42f5053a07decd386332d7c46a12885fae7629af375b0b1a9c8a026d0576932133f6eee6deccc2ea8a98aa4026bbeb7a9a358783d859082781f3aef185a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
626B

MD5
511336dac5d9932358d6c87d2790f966

SHA1
bec59874237375cd4ed57a983730be2aaf4a0427

SHA256
4de7de273973f9385a4527b0cc27a571c2741fea9979a89b32cc482f609c73a7

SHA512
858f75927f8495042533ceb01a57a3db04c809fa457bf502560ce2c1480066617992dd2c4b00a97f3e21b75974fca9ac7088dd0111679d0123f69d6eaa271b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
451b11a6ae626c5996f352666232b1c1

SHA1
44e9df5dea649107467b5d876d359e5b0cb235ea

SHA256
80999c655500f841127b6de7c95a82d8cfdebfba9133f26477d3a37c31e4279e

SHA512
16a7b967d4524fb37be6db7edf6c4c646df373c1d3d2b9025a7a2ca3e85ce74cdd749d1206364567ce00f0a8778d757eba8a29e72a727d8ce1d0238d1fa58541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
743487562a6a2508c29c328581d43bf9

SHA1
a0a34d313a68e1c39060faba61dbbfc338bb8faa

SHA256
5ee1e67ee687c05490dbe8a980c95efc521052ed96b1549b263987a3cde246bb

SHA512
b6c09644b0f8aa8d3a59c2aaca187e9ea0c0bac3f1a1cf42d35e6d85899a8514ba707a89093edc37b10acb59efa4ca407810be9fc69c4ffe4e4019d3e48d0eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b7243826a3f2c585f5091053d82974d0

SHA1
e477cb1cbe7c2f5c4888b6d431313c88948eab3d

SHA256
82c1c439de906662450e06570c9cd338f33152ab0544692390becd1a262b13ab

SHA512
f89df2b9d609362b52bb9581cf49ced3a39844c3928b9a5f44302a30b865599a2f6cc263f6acf43fd4925208e53c282cf04a54292918d0afb2ca3aee44048321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cbe04238f9ba6a68a3bbaa047fe38709

SHA1
41d7e0590ec182692339b2353bba8b7ec5b7cbd6

SHA256
59b848e2a10e60183b623b5f07203dec0f5c1a7d7f90069d2404bd9b7880978d

SHA512
4b194f86d486156d1b4a356c45b2cb1275b9d09f31c5e620cc5ea84b9f4f0a06f0fc922b997778433f61c02c6efc0952ef69f74d5e048af62fda2d04a1da30bf

Download Submit