hxxps://t[.]komnit[.]email/campaigns/py85050h891b3/track-url/hn852oevz3402/d206addbd021afaec9294753a1ab73a4de7c859c

Analysis

max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.komnit.email/campaigns/py85050h891b3/track-url/hn852oevz3402/d206addbd021afaec9294753a1ab73a4de7c859c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
556	msedge.exe
556	msedge.exe
4924	identity_helper.exe
4924	identity_helper.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe
672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2500	556	msedge.exe	71
PID 556 wrote to memory of 2500	556	msedge.exe	71
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 2476	556	msedge.exe	88
PID 556 wrote to memory of 1864	556	msedge.exe	89
PID 556 wrote to memory of 1864	556	msedge.exe	89
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90
PID 556 wrote to memory of 1680	556	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.komnit.email/campaigns/py85050h891b3/track-url/hn852oevz3402/d206addbd021afaec9294753a1ab73a4de7c859c
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff826ba46f8,0x7ff826ba4708,0x7ff826ba4718
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9157075078942962987,14999358283387889603,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
39101e0ca6afcf6b93183546306d2b98

SHA1
b9c9e52efad297efe1bb25232ba778341556fcad

SHA256
486ba11b31da3bedc4539ac60ff6217514ec084dfb69bd5f08eb8e99ec35c8ee

SHA512
a7c8941cfd443b9d466235c344827944a78f4cd5c09f42dc76ebba34bf0a7dd6e7faefa5f7ba589f7bd259b0e0ba5ae9592fecbb2bf073300ad397737c074a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
844B

MD5
29dac9596036a1e67c74f4fe653f2b57

SHA1
740922da3b2c9fbebb4b689aafe9b390cc2fa649

SHA256
156b175373dd8a67d4e6ec6336606abec9d01ce65f8750155105ab804976b113

SHA512
c824920c61e33d73cbed15d33bb5591d09ecfe3e73ee4bce273c869f2e36a762cf3fdf482d9cc28d0116afa212c9b0b5ccaac84f86048a5cd839be8676780b2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3b42e81f1eba0900cfb462fbd60f703

SHA1
edc8713af1059101c7ea519374e1f20d74431d0a

SHA256
90ced9cb154b52913b22b94a5cae793abd45fb47a600350d8ae19ddc551f2653

SHA512
e0ad375dc34455e247290b994137d94fc191da385c0336dac744589a4a721fed52368ee508411fb4f8883190a5a38fecec34b89409f82e7de53df54171bd615f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b367cdbf1fa59742fc387c6f69952755

SHA1
e86e8e38f8f2ca93bc5c03e688c813d0a89d7803

SHA256
433f10cdb59b9bb57f2ea54b2ea1022455f83a9342a6deb0472897320d25c4cc

SHA512
4c1982237528ccfa9f1df83dd3377ae010acf4a3d4ecf7c8a013790db88f1768345837ccd23c40c85a13135842fecd567b5b63c585044682880021b53a346ed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ee4eb0ed170208fd7d4ce63852e0624

SHA1
7448db68ba5b429d279e676de71c600f60f4d9b2

SHA256
02dbd6205f10b44fc7b1434d1fd323d93761539f1a9e9d94ebece021a82264d2

SHA512
1521dddfc3cd3ef62fe524e45ca1a2036e2afb8021600be53f17c37e06996e170222b03a996e694d3ab6134bcf9cf54fe460e022901ab1f7267ac61fa8b5bb13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1eded8330d03ff02055b51df8ff2a1d4

SHA1
0c0b5414048030be8d8c2832b62a213dc9693f38

SHA256
4017e48f064f7b120fb9e7462e6a34e94c67da89e063e3f63328c6cd19686047

SHA512
ad6b0c5d0ae687fc7d87a6872a2328bb81dc792f71850f09ba152cbd8188cfac3be2742cd268325fa5baa1ad423fd01a6e7e64c606d795b5375aba8786e0757c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e62a6848f50c5ca5f19380c1ea38156

SHA1
1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

SHA256
23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

SHA512
ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e42c0b061237f9cb9c5c165d2f7dbd48

SHA1
589afbdf74a63dc63fff5fd1d36b31a281cc3ff8

SHA256
e99d8a0d64330e75a1b6c3fcaed2307a3a33eab5d6ed40093a17d91e3437c837

SHA512
d11360349a9aa5ce451e86355687ad2490b044e6924f377a562095b610f9a374280370a77f4c70ded21c088ef75874fd5039494c278c59d04db34c7817d50279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
694a4819cea309f24b38b6cd645b7cd5

SHA1
bced9862973a720ba31db8470bead6323e268268

SHA256
beeb0e897d958058c44efdf7f58cef2a24522e83c33bec6604aa526d1dc5b19d

SHA512
f86ee8f6df09d8504637e9ae9bf53d31f865ed82bd4a577256c6175bd3ea1d0c332bd0fb5d23f6261145fc2b093bf9c966877ef1397dddb4e24e6e94d8912ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1dcdccfc1e9a27e32c8cf418ee1d8648

SHA1
e107f8c8c3a02ea38474ecbe8983c851cdf1cdb3

SHA256
1c98c615c099d60a17d1aa9c65d25d6692ecd151f5aad4716fcc813d5af48a35

SHA512
c0c1ced1508fdaffafbcb2812ba689dd89db5bed01c9dbe8418d5f1022c48fe66d2c2cdad799cf983965bb1befd95a9cf4f9fbf9c68a4aebbcfb15e3a896bb0c

Download Submit