hxxps://aka[.]ms/o0ukef

Analysis

max time kernel
16s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://aka.ms/o0ukef

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
1228	msedge.exe
1228	msedge.exe
4396	identity_helper.exe
4396	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2660	1228	msedge.exe	67
PID 1228 wrote to memory of 2660	1228	msedge.exe	67
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 180	1228	msedge.exe	86
PID 1228 wrote to memory of 3560	1228	msedge.exe	85
PID 1228 wrote to memory of 3560	1228	msedge.exe	85
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87
PID 1228 wrote to memory of 2236	1228	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/o0ukef
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd777146f8,0x7ffd77714708,0x7ffd77714718
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7910947449385657718,711505168621799369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3300b8028991d6e234684db7803b66f9

SHA1
96df26150566233e1e0201bf17b4ea896861862e

SHA256
5b7786b5ae4ba62b88bdbd0992a8fd96b37e4c7068e2fd23d0b33acf769d00cc

SHA512
2f2dff4c24d4fd60160f70d544059bf02eca983309ff46bb7a1cb4d7c413e291c1520842e1922be55a4058380cd041cb6b4d9e70cdc5e4e00880fe13472df031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7f6a4b84d93993fde98d6553834416b

SHA1
4b4a227af10826f5a2f2e9b232ddb0336b3066f1

SHA256
843a9671b3fab9337d8d600e170f9ac8b200a2faf63b5a8cd16f157bcf73c21d

SHA512
ccfe39c47109dbf71c74ff6950526be7fcd521462f80e69e27388a9757d7f1adebf5f723c46b1631ffe3e2b4aa5829655d556bff8bd7e0f9f87fca46545bfb97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2eb1f0fd2cd8d843f0d2cc5c99055a84

SHA1
325d8b1a816b2c0fd76423cad71fbb3f3c4ecd48

SHA256
b19a231381ad09809968878de06075fae733a228641918f548c6247ab9ad9e3f

SHA512
24e6592f3b7b2cc3b954180f5c3530fc9328fbc053ad1c505c44ba985ffaba380a5718d09d96d8a57df00ce65ac59f4eca0878533fea49521ab1d5292c7a4e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3827b2888045a876727abbe9ac80d6bb

SHA1
0134dcf1024f810b00550fb4a771e6ca34680e59

SHA256
496f3e5bbbcf920078cbe4acb73699421b20ad1b96e98bc62bcbdf460e266ebf

SHA512
58197085f1023a87252251ef211250a53c106bca136631b6cd43bb301a87fffc86795f47ec2a737b2566f26e603eb8e25aeff4a5d766e87c9db1ae79f60dc9f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b367574e36a5a6a31183e5735b97fc47

SHA1
6bdb36124089c1bfb011899f31e7e6d8101b6619

SHA256
1926292f2f1f63e182e3e031fa5e5dc78d77f90dc4b2c08a1a2e4bc87a93d9e1

SHA512
22e2f1a00786cdb4bd5a66329164d5737b4f7b419c9871f8840b28386c86a25071f6f43dcd58b797cd414f0cb8155cff30fb4b0478162937a34fa57b2b7689f1

Download Submit