hxxp://reschedule-orderdelivery[.]com

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://reschedule-orderdelivery.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
1784	msedge.exe
1784	msedge.exe
4260	identity_helper.exe
4260	identity_helper.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 448	1784	msedge.exe	64
PID 1784 wrote to memory of 448	1784	msedge.exe	64
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 4504	1784	msedge.exe	86
PID 1784 wrote to memory of 2792	1784	msedge.exe	85
PID 1784 wrote to memory of 2792	1784	msedge.exe	85
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87
PID 1784 wrote to memory of 548	1784	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://reschedule-orderdelivery.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e38b46f8,0x7ff9e38b4708,0x7ff9e38b4718
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14026234345036691183,10758419870893234469,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
6d1dac3d03b665fbb76f3065ab5c62b5

SHA1
9dc2249460093210a2ff8d5f118f5200e30795c3

SHA256
6c249c8c9bc79106a5ffe4f0dcd05c4d63e2b9f893ed20adcc236331b6f5ed19

SHA512
dbf0645cfdf32f81e36e712df5cf9a80e0fd609daa5228ca9994dff89ca865f2e3125e9d93e7cba1d1e2b18fb6b66d10d28d5fec4a3d86bdc3287af1da22601b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
9bb77b92541526a4589c354b2c8926a2

SHA1
68eadcb03b500e8c3e7c20eb8e3f1816d48af658

SHA256
4ef948b08ff9fc6f82bef4ecbbc050fb9986a8e94e77408fa2aaf373d1769758

SHA512
d27138bfcbc2e0580150a992cbf5db2ccbc65c3d6ed136fc20fd828bac2d5cdc82a6d0016af7d0526d4901bd106c1a86f6383cdd2834027d59daa6e7514788ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
acf323205984bd80f7d81eaac0c1eda6

SHA1
4ffa97256c06532102b7b02b96b340a932d27850

SHA256
e2e5a2f7deed9521324c2232bbf7639cd04caeeadb76fd326e0d42ba8c2f8d67

SHA512
8e69732de3a1db1351d68d039f6a1df6264163633156c109160f6237617e3b1a0a1cbede6ff200395b1253680f2f6f816ffea0a5dc678e004381df8db47436dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b1223f7fae0bfb4312230ac68c46b0d

SHA1
fe3dfd4a8a25bed11fdaf1c0d2af2ce7724da602

SHA256
1735605aa4eff93f2b0cf3a5f86be5dd31ed330cd8499537c0c3774658a983f5

SHA512
a01ad4beabe79316abe0538a265e399c60da4679e1686e3e755572117aaa547e8b1eaaa993de89f4ad981a3736169627f8778ca207c830d4c75025a5bcc2a069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dfa191219562fc4e5e1bf5a6736252d4

SHA1
0368250ebd00b59e4bc7938a331a43d53d2e393f

SHA256
0ea964a92d65af5a643af18df20a5e58713ab12d81375708611f5b4dab402e4e

SHA512
87af7c35cadc5e0d6cb9aaa9ca17b09ee1edc518103ffe4a4a1aaf53ed63ea7bb9eb4059aece237bdb1d86efddac052043546a6fe8891595e814d25f02b76443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a96116d28df60a82e94d87822d6c9fe0

SHA1
abb6cb38b41cc1ae20c03315cfddca8b717b44b0

SHA256
d87170451ce54d77899775de43abf35bc99cfa7a12d404bcf467e12e5b99ac69

SHA512
118a5cfefdf16ae3eccf030480bfd88c7c37b214853ef3c8a4b01a5e78c86e84deb48806d3381e3df8917a7b6fe39fa3fd92c0c2e3938f0238417ca2f7a6f512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
02e6ccfa5605d79a0ab96a8a2f847ab1

SHA1
c9d8e3a433dc76f6784b5db8bb1cdc1f1f702c01

SHA256
578918b169bc21cc2020367333b9d43633d9738c38315831b549a4689fc03b8a

SHA512
a33dbe3486bdedf6f7ff641c7b773393ad3489e254e664b17d581eaf365ae97abd55ae7ff6528661e7005b58c6fe1837d977d8b68853507ef83fc96e2346c4d6

Download Submit