hxxps://marktpiaats[.]run/NL/kopersbescherming/3834719

Analysis

max time kernel
42s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://marktpiaats.run/NL/kopersbescherming/3834719

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
5800	msedge.exe
5800	msedge.exe
5580	identity_helper.exe
5580	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 3412	5800	msedge.exe	86
PID 5800 wrote to memory of 3412	5800	msedge.exe	86
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 208	5800	msedge.exe	87
PID 5800 wrote to memory of 232	5800	msedge.exe	88
PID 5800 wrote to memory of 232	5800	msedge.exe	88
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89
PID 5800 wrote to memory of 2492	5800	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://marktpiaats.run/NL/kopersbescherming/3834719
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8dad46f8,0x7ffe8dad4708,0x7ffe8dad4718
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3171460808355643195,15402033639720799515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7bbe38a5-1376-4a61-9efa-961a202a7083.tmp

Filesize
5KB

MD5
de065b50fd75d7f26e0599732d407d4c

SHA1
11663122370f2b1f0216449f2bd65e5f296b5ea6

SHA256
422ffbf3ac405ab6a421400d8de93b6182f89ed906deea8298c706da4e1a72ce

SHA512
f00c2870a372bba498abd67b6621e5336e8021dc996aa5d15e358bb2cc8fea6155527cf66e23f785c1af019096062400c7ca5370d41f80eb8c983bb312812dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc8c028fca665648adf8b98b4ec89d78

SHA1
8c488e0ade22ede36a9f20b30c9a0cb20c64ae11

SHA256
7b333d032b15c0d168b7e4b9a06f8fbee9234be5e73253c32a58c97c3304f6e2

SHA512
394417de2a143c7d75387f1343d94f4a2538e547d7bba675d599b01c7d5bd1b5f6d795d24b3dbacef2d7fc74f28c3f741125e0b4cb6b3dc41af2726e59b95cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fde669eb89cc43cc35fe5737907431c3

SHA1
d79bdd548c92422bd6bc140f3d8a51e14c48c4a5

SHA256
1ca6c09f200db06cc97825750b60d782340ff4a7bac410ed96a590be74518d71

SHA512
a46eb770a6f88734de36ba941a85653bcfaddc18b4d85b2103442feb381079b8ac999e0209206dad2b357db97e27554488769a2a718521961a9ec67b1be93f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3e8adf60c77e3dae56a0ffe34c89e03c

SHA1
62679798a54544e293fc45c226bc4b788936798f

SHA256
3bccb41055e9d709097ac56cf323b9ee24361e1c260dc2626d3f36bb19e4615d

SHA512
24905630dc58f06194f2f2c1a3435709e92c206770fe14caae73b3e5c83fa1d314700e985b1033be3f48c92d9514b46f4f0d7b508df71116d1c3a532a56bfb6e

Download Submit