hxxps://www[.]mississauga[.]ca/publication/notice-of-supplier-name-change/

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mississauga.ca/publication/notice-of-supplier-name-change/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
3084	identity_helper.exe
3084	identity_helper.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3812	4148	msedge.exe	82
PID 4148 wrote to memory of 3812	4148	msedge.exe	82
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 820	4148	msedge.exe	84
PID 4148 wrote to memory of 2544	4148	msedge.exe	83
PID 4148 wrote to memory of 2544	4148	msedge.exe	83
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85
PID 4148 wrote to memory of 3008	4148	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mississauga.ca/publication/notice-of-supplier-name-change/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffaabb646f8,0x7ffaabb64708,0x7ffaabb64718
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,2469870483746267696,17263629369359312364,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a65ab4f620efd5ba6c5e3cba8713e711

SHA1
f79ff4397a980106300bb447ab9cd764af47db08

SHA256
3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76

SHA512
90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
854f73d7b3f85bf181d2f2002afd17db

SHA1
53e5e04c78d1b81b5e6c400ce226e6be25e0dea8

SHA256
54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4

SHA512
de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
7692cdbea611916635550f72ade5a996

SHA1
2040d31d52cb22fb80d6ccaef95f9c992ec818c2

SHA256
76e898f179cdd8639e6758af45e4bb23a57b6f94976d43e8d5c1d3665a0fc4f3

SHA512
f559959e31329afb704bc7d84bc3f7f0f214a274e01aeb9fcfecf64e9cf7e84138426ad72315af18e3af051de3bc18b66476e732cfc60d5d6f62ecdc2b906c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
19af5ab9cb25986ce799431dca99a0ad

SHA1
ee5bb1a401d65bd4f7e3c805c27e7b32c57cfbaf

SHA256
9aac0512739e05d39bc62501074b8a4b8e8be756175c249b9dbb59471ea9d186

SHA512
94516d55319c78206a973431fc004c462a2f16a05d71be69c26c6c6c9f29686f32918fefb962217914caa369c5b3b1321417781e2af7e45eaf3472e4de9169b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69c251190353fc77d901ee38cbf21980

SHA1
4fb0543d0b248bba55a4a660ea9c1667270a8c80

SHA256
df411560ad8cd67542ac0410db9e62779b96866548816c20824b1878ec2c5cd9

SHA512
9b118247d254759c502a0bd2d4bb38818c59f2dd94efd4e0627ca9c8c2f4baa0fe55a81cf6013e9e2640e96109f48e3e17c5278e43ebbd0fa5633493f0e39a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
57efed5765e575076d2ec7bb4ae619db

SHA1
26eff92f2ddfd0289663763f376d47daf8623d6b

SHA256
7a716a0d3ecd7db865641d6211ad30b274a7df329e9c8cddac2aca6fa0b085d8

SHA512
c889e72780d1927e055e217f8f154de91065ac589ce81e20a962879884ff65b6eb060f9e6ea8223204735bd695ff26d560d5de7eb2d5f9245ced40d283d5c3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c090c72659219944edada6602efdcf28

SHA1
e0c228bb5afdb1fc988a6c66cd41ad5d79ca7f0d

SHA256
d1b2c48a1a44cb3766d943b7efd2ee537f71dba344f477a9a7cecd023bb5d327

SHA512
0c15c0949c884c1b68f946991c928cacdc002e448b92832f116f275cbd9b8c43fc5e0f6918bd8166ec9ff0d5137542a48146bb8ed5d75d4804ab9b2301fce358

Download Submit