hxxps://app[.]crmdatas[.]com/index[.]php/campaigns/bh927nmw9f026/track-url/yf614qfp6r17a/a5a561e82f9edd46482e2cf8a8b0e1d76d85bde9

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://app.crmdatas.com/index.php/campaigns/bh927nmw9f026/track-url/yf614qfp6r17a/a5a561e82f9edd46482e2cf8a8b0e1d76d85bde9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
4632	msedge.exe
4632	msedge.exe
4888	identity_helper.exe
4888	identity_helper.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2016	4632	msedge.exe	37
PID 4632 wrote to memory of 2016	4632	msedge.exe	37
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 1280	4632	msedge.exe	89
PID 4632 wrote to memory of 2720	4632	msedge.exe	88
PID 4632 wrote to memory of 2720	4632	msedge.exe	88
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90
PID 4632 wrote to memory of 3888	4632	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://app.crmdatas.com/index.php/campaigns/bh927nmw9f026/track-url/yf614qfp6r17a/a5a561e82f9edd46482e2cf8a8b0e1d76d85bde9
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8504e46f8,0x7ff8504e4708,0x7ff8504e4718
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8015522853373925754,15731024583511840891,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3300b8028991d6e234684db7803b66f9

SHA1
96df26150566233e1e0201bf17b4ea896861862e

SHA256
5b7786b5ae4ba62b88bdbd0992a8fd96b37e4c7068e2fd23d0b33acf769d00cc

SHA512
2f2dff4c24d4fd60160f70d544059bf02eca983309ff46bb7a1cb4d7c413e291c1520842e1922be55a4058380cd041cb6b4d9e70cdc5e4e00880fe13472df031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7f6a4b84d93993fde98d6553834416b

SHA1
4b4a227af10826f5a2f2e9b232ddb0336b3066f1

SHA256
843a9671b3fab9337d8d600e170f9ac8b200a2faf63b5a8cd16f157bcf73c21d

SHA512
ccfe39c47109dbf71c74ff6950526be7fcd521462f80e69e27388a9757d7f1adebf5f723c46b1631ffe3e2b4aa5829655d556bff8bd7e0f9f87fca46545bfb97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00ec62c5-867b-4032-9be3-bde660408e5c.tmp

Filesize
184B

MD5
9ffb19a53adc7a80ff344c9ee317c7c6

SHA1
d4645eb65465eca555871f9c0f54aad4f100af4f

SHA256
c458c04615b37450154c4fd4a46f87c529336723c4994fa04556501539d094de

SHA512
3f9dae21a15139be8d6dd9987cb4c6d501a0327a899fd3811ab9ce35462e925b39d931f9469e14d48a3f84b928636476f6d17cf075414605638df418bbe3efbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
20192c65184f375546f5bc2a7f1a4198

SHA1
08605ac3219eb59bff18085b618053542495abc3

SHA256
65c71cda2d6037676701b86ed21c1cc37dead336d7b65124c867ce32b87f3d80

SHA512
0d106871e7c1ef87016b327af674030c5ed11f64a8351994d3957ca7c01c200dfc77cd35a20a6e6b3efa75372c14948cfdd285add2f23b5c1b6281fa0695ee2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc664f23eb180a04e842fa1afee0468a

SHA1
dc2207b8bf01f1696eef703aa171a360a50026d1

SHA256
b192d0204a8f7b4f42e6630d192737cd3394333291cbeec62c2a42d35f336663

SHA512
fa4b271ed90d2361f62e6900cbcd795990e26e592076bd85918b39d02819a236202c00e029eeb50f7181cbd061f80e06f1440240e6be5f1455ea57a81d747ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e8f1d0a5aab8f2b06f2977f390e9330

SHA1
486e976c104eff5f42913b452e166bebd050d8ab

SHA256
2d5d19dd970bd73933df867b15767fa00feedbb557de15ab724edae818e94a7b

SHA512
8f4ba22db195c14fb54abe26e495329f41d64ee71d10c9d5aea2fafb05bf5ba9f10108e07a64e19bc6c2fa0a5a834654b706161affdff40a5a3531923884070b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a35e20e19216db31ce30df073bcb0d3

SHA1
f77f5b131a6809aab2a9fd765b0994c5cd15fd87

SHA256
23f65da42b2b868f313a51d72563443176b446ea30d8dd4cf004f50558e742c6

SHA512
dc4ed612ddb55b54440f2bfde73219661ee1680820a79891e0dd913510ecfe3a09f2b2fe58a58fba222d77a4b8ed7af17335cef1b1af1b24b45e34d38c31f7a1

Download Submit