hxxps://www[.]hybrid-anaанализ[.]com/sample/171562a0b0680e2fd9a 0c358d8c13d3f28849e51e7d62c106bed8b8ee3fdde65?environmentId=120

Analysis

max time kernel
21s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.hybrid-anaанализ.com/sample/171562a0b0680e2fd9a 0c358d8c13d3f28849e51e7d62c106bed8b8ee3fdde65?environmentId=120

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
2060	msedge.exe
2060	msedge.exe
3468	identity_helper.exe
3468	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 368	2060	msedge.exe	21
PID 2060 wrote to memory of 368	2060	msedge.exe	21
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 2988	2060	msedge.exe	88
PID 2060 wrote to memory of 1052	2060	msedge.exe	87
PID 2060 wrote to memory of 1052	2060	msedge.exe	87
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89
PID 2060 wrote to memory of 2116	2060	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.hybrid-anaанализ.com/sample/171562a0b0680e2fd9a 0c358d8c13d3f28849e51e7d62c106bed8b8ee3fdde65?environmentId=120
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac28c46f8,0x7ffac28c4708,0x7ffac28c4718
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5967813423115575104,4136854591910862905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
41b8ef3fa19d23b1412ba42c8f007065

SHA1
994c0826d5c305289a1537f01d5bd287d1a5b573

SHA256
dea9b2e844b2b83da51267ef98a4bf4a0fb13d5237a8cdbe231f4a67d3e60abb

SHA512
28289c530a65e8d61c7421161d4cd55c2d0e26cf693306f37b53dd010c8ac2983da6b67154e4ff10a1b35b2ad49d46dc5f49aeab888ef520f1cb378635ed0bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02ebad992b1f251e4c072bec1bb8ff0b

SHA1
dc68572f4e38a68381880cdecdff18d0e81c11b9

SHA256
71341cf6c24b2b4370503b88b711959e971086ed0d251a25e36205dc60e5a038

SHA512
547792655abfc8d5b115f246b58e6ba6bc07ab77617c3198444dfc5b4a1e64e76acc57792316d21924ca390e1f195825e98b4bea5d184d3d4ef741e779308311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4b3f81862b25066f7a08a03f9718eeca

SHA1
d8b4382a0488e0d849b271da85430bd5bfcb89f9

SHA256
cff2fe35b5e609e07bcc38f952137effb28ab53d3d1b09b1e19bc255016a5e3d

SHA512
50d4a9af6bd5cbea665750f125a291bab3d18df6807aafca4e4e9f48df9874b8924f9a11339cf0956c9a0618d236ba33876d586d8d81d566a6be4e5c650903f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f01c85890df3e3a4676c0be388376816

SHA1
479825842c471c67076290a56e4efefdd13dd7d0

SHA256
b997b8039e3ae865b8a58234e5a9d97ed51acd70d3a48087761118f541e72e20

SHA512
a3a6cb5523551cb18317f9cb2e3a39ea957a51bba07c6ac5dcb22af0a78568b170af58ed22dc5951461455936c0c625fae5f311e7e4474f0a8bc0837f8f69178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f7f9dbea6f0329e0fa37d9c9fb36d112

SHA1
98eff2289b3f825fedf51f5141ddfa93029a6878

SHA256
f5cd72f09f61c4cb31cfa355be1fc25c3d4b6225638a1da4d47b4ef89f701f7c

SHA512
fca8f136ccd543dcad6a3de697481db039a0be006028e534ca646848a97c3c4110ae9dd2a3d0d4f7f86ef0e3986cf58c5aae271bf1a102136e03658edeabc26f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit