hxxps://telecom-knowledge[.]blogspot[.]com/p/calculate-antenna-tilt[.]html

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2024 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://telecom-knowledge.blogspot.com/p/calculate-antenna-tilt.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1804	msedge.exe
1804	msedge.exe
2124	identity_helper.exe
2124	identity_helper.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2016	1804	msedge.exe	85
PID 1804 wrote to memory of 2016	1804	msedge.exe	85
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 2620	1804	msedge.exe	90
PID 1804 wrote to memory of 1064	1804	msedge.exe	88
PID 1804 wrote to memory of 1064	1804	msedge.exe	88
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89
PID 1804 wrote to memory of 396	1804	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://telecom-knowledge.blogspot.com/p/calculate-antenna-tilt.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe84a346f8,0x7ffe84a34708,0x7ffe84a34718
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,1997427621383094728,16303290962752506805,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6368 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
4bcbc8e1cb771c83308ec2ffd34f991c

SHA1
214590e1a111aa7c2ab921751705b964e4c319de

SHA256
28cd24b5327738b97abf894247f97e07c8e1c534421bc56fc32979c6ef0cb3e2

SHA512
e8cf8c34526273b705fd4cb3db910f9fff44a946b8619e740f584fdce44029f529b920f65589012a1478b3dac8d5b20457c979c30790c3210f68f2b53aaa6639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
e0af60a009616e553c6b36546689204a

SHA1
933c2fa31cbdedfea6fc7e8a6a44db357d15ff2c

SHA256
58f6a0c19ddc997d1ce1d6f9f65b94ed3e7d073e9365bc7bcf3a1a5d923eb5ec

SHA512
cef644e9b8b28ac2ce9ed07f2f42cdf8f639937618e482ebdeaa51ec4f006c0eb6c5ef18e41bebbd95db843ddd24ae718b84d37e700b855ea4361adbc3d03212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e37a4e2ead4fb87e04db9c463035255

SHA1
16744c673d89f4eb488be625c17750fc6ad0b07e

SHA256
73e016522304c0ddb9a55055a5d7f2841b6158aa67234af87772c0e084f2aefe

SHA512
5ea38d11f3127ac3d5cf590361435ac443500c2a931822129c6f890a8074eb790c86a9a5509022e61f8b147ce1073d8dcfc47b5845efeac9f351e3bc6eb5ba9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a341988f8af3f53f7090e7f11d20def0

SHA1
ea8803f7929ad03171abacdeadc2f33844567424

SHA256
3273c761a11a88e0a5c830931be5c373b1d37436753674a4d06b5d87ab82757e

SHA512
6b7dfe60ee4e642f86d6a0200fa4f3174d302c75d94ca965e44448a01f1d406ba51b3b7952e03216775c6937a0ef6552e4eeb156b4b9e8b814ad20e24d05c7f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b21f12b2aa2a6f39cc634bb0a062a796

SHA1
f92fc76f7e6d8d2a3d586d9423b52c7607f0433b

SHA256
098ad41177f7aa4edfc5411ecd695b5370bc579734f6aea4c8304a586ea4eeb1

SHA512
2f8809dddd73c6fbf66b359701200e29ff9c2cba4b463d9d0a7b9bcf5cf77ea5ba34e544f9fe5b16fb508a7f9e812cc53794c4b970ada1ebce368cf29fd9048c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e33395ba0dee0354e1bf2b327e9f5acd

SHA1
c6277bc2528f2b047a442a0e495b45f53979ad45

SHA256
72d694be568867c8e81bcf24e43785d777f5d48381fcadbb3e15dc880c11a215

SHA512
9af71f407f54430f3d7a1830417fbf9d4cc2db0c6d025f391ad3742ac8ad5ab58b7b82121447b5a167094dd8b9687d79c7da6ff621dd8a5d217aa4c16fc1b21d

Download Submit