hxxp://dechoker[.]clickacumba[.]com/unsubscribe/2542756/979658bd1b46fa77d991f3c2604afd1f/S4LDsYEkPn0L2IX9wrVqZbwSlEUwv0JDSQunO1xfYuoz/?oneclick=1

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://dechoker.clickacumba.com/unsubscribe/2542756/979658bd1b46fa77d991f3c2604afd1f/S4LDsYEkPn0L2IX9wrVqZbwSlEUwv0JDSQunO1xfYuoz/?oneclick=1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
4036	msedge.exe
4036	msedge.exe
3400	identity_helper.exe
3400	identity_helper.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4188	4036	msedge.exe	60
PID 4036 wrote to memory of 4188	4036	msedge.exe	60
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 3916	4036	msedge.exe	86
PID 4036 wrote to memory of 1444	4036	msedge.exe	85
PID 4036 wrote to memory of 1444	4036	msedge.exe	85
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87
PID 4036 wrote to memory of 1472	4036	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dechoker.clickacumba.com/unsubscribe/2542756/979658bd1b46fa77d991f3c2604afd1f/S4LDsYEkPn0L2IX9wrVqZbwSlEUwv0JDSQunO1xfYuoz/?oneclick=1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90c9646f8,0x7ff90c964708,0x7ff90c964718
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2994217317237835456,17331047026244302265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
192B

MD5
d899b22af52eeb51b622106889a655f4

SHA1
edcfe4ecf14e0a9d9a3608f2aad99ead09ad42e3

SHA256
77cb674110b08de51eccf9dfdbec345038068a6f1ab1167bdbb9cfec3064f0d9

SHA512
8d8d6313eab30086760e797215aa14c43e0bd40c60f15ae3a2bb22bf2044a241b15abd0e356580e2a0bc0771825bf084971183c17af2d5dfd802128f8888cb59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
050ea7cdc95577c6e4a9c858c7d7d787

SHA1
f8aea2066ac322f1f9a7a9798075310990cb0bb6

SHA256
6b2f4fe4c41e99ce3250c03c1d7174e67a8a739598d6e4e3039f67f1db18cdf4

SHA512
b4d3df5a689f2a1d76be8cc260b10bd282df2eeb31bf6176207778134ff833dc6f741da358690d1c5311cb4235a310eb4c303d899f50104df2eb8ff044c11ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2ccdb7eb10b8b81801733f1a4215186

SHA1
3e64c7f6e8bb392141461262db7b87fbfbdebdd9

SHA256
0a869193578de9f703423820b0d58ae2ed94f1e034799b78ad3a13bfa90314e1

SHA512
73a58a135a1420254a96cf54ec5f5a0c3d769464812513990d8e410aa108768b35f96ffd7647f7d0daf6a558295a660cf12888e2ccf8ab0506ab088e774b6a12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e5f7ac38a1546147ae20818e133a80a

SHA1
37a09cd0da6b16489022dc8ae83f452c6ed2d3f1

SHA256
6e4d798caafa9c0f4b8bb534fc2b8fb862fa094425dce149d61b19128cf42d5e

SHA512
f6c1fd89bc5d7223f650669a0d02c0b09f5d21afb0eba6ee16ce911a7bf1a15021653abe047d972d88f7725ea9b3623b7ddfb46f437d78bc18232db44b1f424d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2bcbaa4c33bccbd2647bdd6c8aca8e72

SHA1
cf1f3a18b640a1101f27b349cd849dc9f2fb8f2d

SHA256
70ba4edb6e9399bcedf4dbbea2a619f802a6960cfbdf33615eb64d92268f1fb7

SHA512
f617c685720f0e1d3580b7ca971106d969c6cda2280a7b039c1a11eacf0df737e62ae94c7264e3ad484fe0599f66227238c31d66f6b0a9b8b2a899acf8b188dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
61e9562ca62eac8ca5510d0f6fda7132

SHA1
1ff17e91bb427a7d40595c31c3db99827adbea76

SHA256
a489f6add1f1f6002456e8c0008776202c749b36e8d2f7425908c0eefd9c01d4

SHA512
afa25579661767b78ca1f16d449f9e51657f6da957273151bdca2602b7bd4db5db39f6c996641448a4f1f7060bdbc5ad4acbca73d17acd46b987c96a96948b28

Download Submit