Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2024 01:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://aerologistixcr.com/qKHSZ
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
https://aerologistixcr.com/qKHSZ
Resource
win10v2004-20231215-en
General
-
Target
https://aerologistixcr.com/qKHSZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 792 msedge.exe 792 msedge.exe 3000 msedge.exe 3000 msedge.exe 640 identity_helper.exe 640 identity_helper.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
msedge.exepid process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3000 wrote to memory of 2520 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 2520 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 4040 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 792 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 792 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe PID 3000 wrote to memory of 3608 3000 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aerologistixcr.com/qKHSZ1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc236446f8,0x7ffc23644708,0x7ffc236447182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7459278709086236685,18282565791212282023,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1300 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57a5862a0ca86c0a4e8e0b30261858e1f
SHA1ee490d28e155806d255e0f17be72509be750bf97
SHA25692b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b
SHA5120089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
186B
MD5151b9ac328d0ade8158661230ff15021
SHA1aa0423eb9a188096a91e94e82bed52cb2d73bab9
SHA256e43e14883213d915fdd10a55b9d42bd833771e956e5c56571582174fa9c81164
SHA512ce1f4008bfa504e930f29968847a45b02e474abfa6a93ebaa6d737e17b9684acd59bc60b0278c9909d5c1ff1f5f4898e4c75ad962f24ee77090a4f96c1a74c90
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5a1cfdf5862d0cc610e1c1f1449207e27
SHA16da9cd06ec1a73bada0093c6a85713384ca7991d
SHA256ac68f38ef3197fac953513513b301b0d9c3b753b3b9d3849cee283813b4f4795
SHA5124893d2f32d877bd7d1fd184ac5c6f1dbe3b9aa7ec3fd1e14d04a02a8af7f4a6ffdff2fa036b63165a13e5e5e746f59de18cf275862fae7ecb7c36d836acfa42a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5e9190b8e660b6cba5480b9f9c276a9c3
SHA15ade25c3043b15d5ec952fb8a132b5274659b7d5
SHA2567d6bb716e93a224a0cd6338bdd10442ca3c82623f9ac5eb1ced79793109f9276
SHA5123a777366a3a70c836f35880215a569897248830ccd6b9501c2cc09baf2bab27a579fdc6c47a6b36826d34b5bef5b288049c3a108f4c1845d6fae665c0cc4555d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD552826cef6409f67b78148b75e442b5ea
SHA1a675db110aae767f5910511751cc3992cddcc393
SHA25698fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb
SHA512f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5de2740246dc4758647c60ce191e63a94
SHA179590186f8f15595999c583781413e6440602802
SHA256adce19679b8f500686a10f24abf1aefd454c78c3cc86495b83e298e2f8e62daf
SHA512511a087cf22371c22b8c472616ffe242652e13c5b56d24111269d144f5b15d21cf5527cc7a5c2678fb032b30ea598fec43ca63fc24c1da3f34475ec6ced8ae22