hxxps://cl[.]s13[.]exct[.]net

Analysis

max time kernel
145s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
25/01/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cl.s13.exct.net

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
132	msedge.exe
132	msedge.exe
1440	msedge.exe
1440	msedge.exe
2404	identity_helper.exe
2404	identity_helper.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe
132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 132 wrote to memory of 324	132	msedge.exe	77
PID 132 wrote to memory of 324	132	msedge.exe	77
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 4484	132	msedge.exe	80
PID 132 wrote to memory of 3824	132	msedge.exe	78
PID 132 wrote to memory of 3824	132	msedge.exe	78
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79
PID 132 wrote to memory of 3216	132	msedge.exe	79

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cl.s13.exct.net
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc26343cb8,0x7ffc26343cc8,0x7ffc26343cd8
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1716,981529424787046661,15418387953909147531,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bb88128b6b2d63f04c36ce68ed52d0a1

SHA1
29cd0515976a9249fc96a9d77c9986238cd1c2da

SHA256
19341f9fde32349d43cf9951f118ebbff856499e0e6875101eaf2db37a7d7d8b

SHA512
ab3071e116a32fc105a868fe9f3cd11cb282fc6cdc1e101b09c7f6269502f98b34b2f0a2ec32eb2b537073e2b20bd22cefd2fdcd4be87f8b169e6eed3bed1ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
6d17ff09fc1c9df0295ec938479a4783

SHA1
b4599b695bfd80e249f8887659d7051bce7895a7

SHA256
65ef89aad8b39b2bea85813cd6b46b89f91d524fe8714d81d4323f5af0fc4d1b

SHA512
4f81390a9f32b7ce8f515d6aec959b82c9e3f922f59301180bb835e4a98a69eaa1142fc03ab222e70dbf75b06b36c7bbcfce8e03f2c77f77f6b9b16c8ecdcd8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
193886f245b19d22faeb08f8d719aff7

SHA1
d72bbbf02f6a79f8334891dd3f434cd07c65f65e

SHA256
9820c935e1f5686f9618e412b60c96345602d18d5d82eaeeb5a2324a542fc77b

SHA512
05e6f4da5ed678b78b4cf402c08b3db82b80c42b8b7f732a493edb7d927ed6cb82710dd8256b62b61351d99ad927edf58433f3fd03a7717cc2e824a947e82ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
87796f83a580ad1059639b7b6f48c978

SHA1
3aeb3452c1d42aa82dcc46fac0eff546266958ca

SHA256
ca9281ab005e47fe20e132b81ccfbf7a5f0e6d845cd3412129bcb07cacb1397d

SHA512
196d07ff37bf35b583ba80ef92e0277eee328925a77accb3dae1ca10a356a7924f49a7e6233db1b8b320eef6beeb9677ee7d642dd4bcdb2f1343cfe84fb186cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3c4493f4dda6f167ce82f44c8db6dd3e

SHA1
2d8ab0336620a762849ef80b01d8741c6be1d550

SHA256
97b4b0bbdc8163e9e456834a16534950f34764675cc8837dede22ef03e37d147

SHA512
f3fc14d163d58eda91075f83fac2bf7612a359bc23eb12cfde3306824d6fc8171c17e826173a82f36de3914333982b30ccbd27d246a0b1fa1e99b5605a6de522

Download Submit