hxxp://url[:]hxxp://gandcrabmfe6mnef[.]onion/8b9c14fe8b0c1d15

Analysis

max time kernel
51s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://url:http://gandcrabmfe6mnef.onion/8b9c14fe8b0c1d15

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
5728	msedge.exe
5728	msedge.exe
3884	identity_helper.exe
3884	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 3180	5728	msedge.exe	58
PID 5728 wrote to memory of 3180	5728	msedge.exe	58
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 5820	5728	msedge.exe	85
PID 5728 wrote to memory of 2584	5728	msedge.exe	86
PID 5728 wrote to memory of 2584	5728	msedge.exe	86
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87
PID 5728 wrote to memory of 1324	5728	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url:http://gandcrabmfe6mnef.onion/8b9c14fe8b0c1d15
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc458346f8,0x7ffc45834708,0x7ffc45834718
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,11874554122597706305,16362061047361384503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:5140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ff1fcb593187caa2a5127cb2594a1f73

SHA1
6e69165393ca9bdb58a735515ef91ece820a25d0

SHA256
6843fd714bac1c52e1eccb0ebd48e72b1170fb45cd0fe81fe87504a1da789f2f

SHA512
35b73147d3c1e87687d5867cecb58cc436639b3502ea01c96b2388124743ebdd972b8b981e436e8cfd3a1f674c2db3f094060f12fffb672bcbb7eb49fcc2dd83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d3e92a51e5280051897bf5e6fb2481a4

SHA1
334c75d76e112a17f0ae54fb03a88c477a684aaf

SHA256
fd4f7edc0c1cc7bf4933c6021be8f67b0d6608cb9b730cfc30f067f80c0241b1

SHA512
28c1f4781ad7fbcc275ea3578e215ee384dc7a17dd348e54f442e71dc4ddc1868d2b1b94084dba495917b6e75a49b9c34aa057ed85524f27b9be5d67a60e6419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2a6e20c60d0f874885e26c7e76714178

SHA1
40f1b84c3e96c83baef88b8175d201037f09d6a3

SHA256
19a3950dcb8e639ab605307453bfbf11dc00d62131e65a135c53d9fe7222334a

SHA512
78d96a01e3c827ec2e57c7174f9b9a98f29e0db7916019263e10aa62286f9df65b4cba807e0dfca7d6b20f91a0739a9bff3def163080fa7385e769a89effe9f8

Download Submit