Analysis
-
max time kernel
87s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 19:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://my.rtmark.net
Resource
win10v2004-20231215-en
General
-
Target
http://my.rtmark.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4740 msedge.exe 4740 msedge.exe 4756 msedge.exe 4756 msedge.exe 2432 identity_helper.exe 2432 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe 4740 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4740 wrote to memory of 760 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 760 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 2892 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 4756 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 4756 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe PID 4740 wrote to memory of 1212 4740 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://my.rtmark.net1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8a1346f8,0x7fff8a134708,0x7fff8a1347182⤵PID:760
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵PID:2892
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4756 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:1212
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:5092
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:3344
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2312 /prefetch:12⤵PID:3752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:12⤵PID:3240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:12⤵PID:3772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:12⤵PID:2112
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8462176940770151299,16466182261264689699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:12⤵PID:1404
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57a5862a0ca86c0a4e8e0b30261858e1f
SHA1ee490d28e155806d255e0f17be72509be750bf97
SHA25692b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b
SHA5120089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\727c922c-5b5e-4b24-9b32-ccd7b461d134.tmp
Filesize5KB
MD5630ae325014baa92b354b2d9d98bce85
SHA1c32e21ee05f1948429d9e08533e086974c23cda8
SHA2565bcd18f655632488cc7f377a0d8856c67846d43a2a2c47a0d7599e0357f1958a
SHA512f392b070a36df19505d0c702168aaa80d22f5ff14914321ee185ac19cb6d904fe8845515dc29ffcd10328d2d82da9d03f72883d1497e4842104c9fb2f608d521
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD54464fc993b8621fdd918b195bb559930
SHA1aa98a2063bf6026c39466d815c9d57660d390ea2
SHA25602200eac04ab65510b0df33e8f1cb3e6540b4c61169020463fca7276797f4969
SHA51232182b28b11cf1d372393dc40c18701505231e58c86611c4bcb74af9edbcb550ac51e98d3f7245eea1e21eea9880dac80e6266329cfe9e5b27322946d4b511c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD562899fec789e4c84d2f27c8f6d6848a1
SHA152ab8eee55694575a241e70a86d9db02552ef77d
SHA256cc35e1f15697a992b872eba41bcad7db332b85250c7f6b9078426770c79052fe
SHA512909f3368d24fe357b056f563b926e2a1a70f6845ba0715a87b74e19414c43eaf11b463bbf778289a90a66d5628bcff3dc734c8a1291fc268007b0031c67acc61
-
Filesize
181B
MD530f245817a32398e1aa30c422a6b1664
SHA1db76f596c151a775be1a93ad3e761f6c8a5354a2
SHA2560e291c3e167a87963bf5d68923cd46f89948773958da17a1060defd4855d1e3a
SHA512d895008655081733ee5af40844164bb70863d34c4a38cafedc8d6a5f68b4a16c6968c13e088675c6e857d6600b38025b32d86686064e51b0c31ce6aec60f096f
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD58e8fbb8e02e6d4b93121af2c35c5dc35
SHA179367909e1a79d9a2c04f48747840244b48296fd
SHA256742d97e2a359fc231f014aac59c2afbd7dade4103b66581b26595a2cde1a6cca
SHA5129d52c897bd33683ec0a6757569a97c71cd90894fba175a5c8f4df6eacdc663cfeeb18e7ccf9f13756436ff2e607faa7e83b07c551da66b6debf035d42bfc3981
-
Filesize
6KB
MD5c90ba05a71bc7a7685aa305afef85fd4
SHA1ecddd6fb55951606d63075a1ff2eb34ace558fc2
SHA2568851bbb920d18bb0dfb0bff6d013fe0e8c37d778e634bf5e9daaa550d052442c
SHA5123f1a27a4babf094f79614111778635543f8d10a4aaf6eb476f18ea476d539f4b6a2337c7575851b31c91fce68a8197831fee1d53b3e5ac60c5c162d7fe78c473
-
Filesize
5KB
MD54a6740dd8731ec517cac5706e69dbd79
SHA18ec29fe01764e4526890d85ae7deca2cc689f124
SHA256cfbca0984c49284e8606cfc6b586d96e569e0bf6c027a3758c24a79ce33fb08e
SHA512f6a1af515805e22c0b1d4d97782408a0b2458ea735206f6d84d3920ea917e2b82d4212d0b6bb78c9e53b84a8dab31df1360fcc60bad1c838f27e579d8e312cb7
-
Filesize
24KB
MD552826cef6409f67b78148b75e442b5ea
SHA1a675db110aae767f5910511751cc3992cddcc393
SHA25698fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb
SHA512f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5f6f79eeb09a0a50f2086ebc429c640c1
SHA1747d1d89551375bb1662e9dac32a9e69caf52b64
SHA256c2b7d57781aa5ed80e5f177ab512f3627e6463b4f317a54c5239ba70714f6dd4
SHA5126390ff9a1a020b7da24d6da86f8f75c000882a6daca4a1e5737539f477530303de2eb3704d4a20003572060d72ca9c9fde92493cbfd905d19a3a6f85c4e0b1e1
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e