hxxp://images[.]mangafreak[.]net

Analysis

max time kernel
23s
max time network
25s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
20/02/2024, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://images.mangafreak.net

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
248	msedge.exe
248	msedge.exe
2508	msedge.exe
2508	msedge.exe
1772	msedge.exe
1772	msedge.exe
660	identity_helper.exe
660	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4536	2508	msedge.exe	66
PID 2508 wrote to memory of 4536	2508	msedge.exe	66
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 572	2508	msedge.exe	80
PID 2508 wrote to memory of 248	2508	msedge.exe	81
PID 2508 wrote to memory of 248	2508	msedge.exe	81
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82
PID 2508 wrote to memory of 4468	2508	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://images.mangafreak.net
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff89d343cb8,0x7ff89d343cc8,0x7ff89d343cd8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4582207973296061490,1846812895795757238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53b9b1800c90e0f055e0daabb68cc97e

SHA1
beb76399e32e4ca5c634228e2d4001e197249cf0

SHA256
edac0665854b4e7aa3f2b866e6172c71b2e1c6a169a2a04cf1e74102ee9c0e5e

SHA512
87d516b7ae594902b2544e13c6224760e1ec40d676a2f699da3242b5d3a9eb962dc7b3ca7e2a3eed1dac5375cc6fd8379dfe47d127fd3c18a653a05a8f67c31b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
5a095e5f95c2afb56442b10b4832b90c

SHA1
ffaa38dd85d2376b84aa06c57243a801891f462e

SHA256
b5cdf33da193d10af1c8a9512bb97fc3074dacd8f6ab865b20fcb4669f959748

SHA512
b19e14512e63e936818224e2810d073cecad7533145493941564d647846dbd1364842e9dd82f2384e8dfe7993109fe6e285b4a6fc7c3ee1e182a4be50135844f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a9de745363805fa297a1dfb83f3eba97

SHA1
a70e75c78233f57ebfb3f08e6e0934cfb541ebcb

SHA256
bf55696d00209c0d6bcd5039b503cf74b3c7d458edb77fe0bf4ca2b742632c6f

SHA512
e3bfdf9a10dd477858d8140b08ed175a719f89d19e18c8e89f2df044f37d7c2b63a33c51c5331ae2776de3a308f5d24274b226572a77d903688a98a140bc4db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a75d2bc59651f125a3f0c6f832f4b1f

SHA1
4f30f68eda82ecdb83f756dd5b74e234a695027f

SHA256
4a51f154976635d2132633836fd16c7cd92aa550478b6b91bc3406ff08273462

SHA512
c553e8e079e1e79b1067baad401e9420985a9ed2d1f68dd333a0228ab2fc3643a792ddc5028a932c2fee67fdb01e8b0e38fe12b9d3d70d43bb6bee4bba840c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
c82ad8ad14e526ec66559c47de1a763f

SHA1
b10b0f130da2c65e86f90dea7ee0a7023d5c2113

SHA256
daf64997d996dd9b5fa74cfcf401181709c99c832ecac0765dfa2685a4de2d26

SHA512
77f20db71a5452fe0de763080ca73b3e55cb0f38bce7805eed977eff6d932b7b081f896be7d9baa8758cb0677e12848f60e08dc2b19985dad0476962b0ffcf66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd1f8d885f521241e4ca387199f01ac7

SHA1
a3e8bf78036ea43c1532423b90a6030b728323d8

SHA256
1f380fc40054b046d347a6d7700ce870394c9382e85b7805c992f26cc5daf45b

SHA512
dfe7d170d4778dd93417c148b8768375c4914e8994ac8ae345fca6d42c9370ef37ebcee77cda070158b64c2cf3f602cc442b1a48bd9175e8ad159a0db82f6d78

Download Submit