Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 02:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://system95.gotdns.ch
Resource
win10v2004-20231215-en
General
-
Target
http://system95.gotdns.ch
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3264 msedge.exe 3264 msedge.exe 3112 msedge.exe 3112 msedge.exe 3384 identity_helper.exe 3384 identity_helper.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3112 wrote to memory of 2896 3112 msedge.exe 87 PID 3112 wrote to memory of 2896 3112 msedge.exe 87 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 4860 3112 msedge.exe 88 PID 3112 wrote to memory of 3264 3112 msedge.exe 89 PID 3112 wrote to memory of 3264 3112 msedge.exe 89 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90 PID 3112 wrote to memory of 3064 3112 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://system95.gotdns.ch1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff89c46f8,0x7ffff89c4708,0x7ffff89c47182⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:3064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:12⤵PID:860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:12⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:12⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:12⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:12⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1132 /prefetch:12⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12842285313365678758,5541151597642098962,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3512
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3396
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5bcaf436ee5fed204f08c14d7517436eb
SHA1637817252f1e2ab00275cd5b5a285a22980295ff
SHA256de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120
SHA5127e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99eb0f22-bb2e-4939-b9d1-939a875dc481.tmp
Filesize5KB
MD5541018b31acad3e3fbc5be268ffd9ca3
SHA17f7b01790fa4858b10139218f20e489bd28cf49d
SHA256ed2ebb3fdf96bb78d5b089f9a592abfcc1245be01c89be15e083c3862c337655
SHA512cc605059bf9cb59aa7206f0f463d9f7685d691bc7d23e3f76228faf21a69ebde720843654a378a1e4fed60ca384fa2c11ab4691f29c19569d92b67fb1180063b
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
24KB
MD5b0ba6f0eee8f998b4d78bc4934f5fd17
SHA1589653d624de363d3e8869c169441b143c1f39ad
SHA2564b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f
SHA512e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b41ee01c-7d87-4050-b444-38e2b19b84c6.tmp
Filesize5KB
MD56c3ff5ad256d67f830f240c4ff2180a4
SHA178c81d59a1f7bfe00ac45a77bccb0b874854695a
SHA2567946778facb2cc0eed420105917d39e7d1af68ddab0c029dc4e68fa6002bc1ff
SHA512b1a15b36fcda0c19b8bbf1007ac5801dfcf6186554aafd071aa1b016450deb66f540b58623889ae1173940a049b27579f181ea440a04d9726cf0874c527f3ddf
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD528217b89a47c420815d0a68819cad992
SHA11795cf2d5b60779f2e4bdc514d621d2330e35cef
SHA256161558dd05bd05581ed7fed5530484a7b75268c936fea10eee5583528c9e80ef
SHA5121e1219d8b94df6b0c1fb078ea9b0763492e943bdeea4384946054c39fc4e1edecf7cc32927aa982c734d35461e82add938beeddc74867cacd957f72b324a34ad