Analysis
-
max time kernel
6s -
max time network
12s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 19:23
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.peretarres.org/lopd?utm_source=newsletteremAMPemutm_medium=emailemAMPemutm_campaign=142024000210&CID=0N99-855Sal097-9V&RID=2683&PID=41630&EID=8135418&RCID=4697&[email protected]&IDM=13871752&ENG=2&EDOM=tdl.hvivzgiivk.did
Resource
win10v2004-20231215-en
General
-
Target
https://www.peretarres.org/lopd?utm_source=newsletteremAMPemutm_medium=emailemAMPemutm_campaign=142024000210&CID=0N99-855Sal097-9V&RID=2683&PID=41630&EID=8135418&RCID=4697&[email protected]&IDM=13871752&ENG=2&EDOM=tdl.hvivzgiivk.did
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msedge.exemsedge.exepid process 3852 msedge.exe 3852 msedge.exe 116 msedge.exe 116 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 116 msedge.exe 116 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 116 wrote to memory of 4272 116 msedge.exe msedge.exe PID 116 wrote to memory of 4272 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 2556 116 msedge.exe msedge.exe PID 116 wrote to memory of 3852 116 msedge.exe msedge.exe PID 116 wrote to memory of 3852 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe PID 116 wrote to memory of 3268 116 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.peretarres.org/lopd?utm_source=newsletteremAMPemutm_medium=emailemAMPemutm_campaign=142024000210&CID=0N99-855Sal097-9V&RID=2683&PID=41630&EID=8135418&RCID=4697&[email protected]&IDM=13871752&ENG=2&EDOM=tdl.hvivzgiivk.did1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1a1446f8,0x7ffe1a144708,0x7ffe1a1447182⤵PID:4272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,11483581851621234628,1750340492971898286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3852 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11483581851621234628,1750340492971898286,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:2556
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,11483581851621234628,1750340492971898286,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:3268
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11483581851621234628,1750340492971898286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:1964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11483581851621234628,1750340492971898286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:1128
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11483581851621234628,1750340492971898286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4088
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5efc9c7501d0a6db520763baad1e05ce8
SHA160b5e190124b54ff7234bb2e36071d9c8db8545f
SHA2567af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
SHA512bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abbe7358-e469-43cd-9a07-b442fcd1e1c2.tmp
Filesize5KB
MD595ce77c24ca595b6bdbd87708bb3ce6c
SHA13fd9b3d81545776a126a06e0e6250d8368d36ec6
SHA256b53d9f4876c19060af61d391b4740078a4f720523f51e75287e9e66d26bc40f6
SHA512cc4f98847a188b3164db448bdb5b598c54f33fe74488f8706b03540a6c5c6ea84da2d25cd08b1d3d5300c1b519a177929ea2cabed44e49897d24f47b49f8b182
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e