hxxps://emailadmin523[.]wixsite[.]com/my-site

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
23-02-2024 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://emailadmin523.wixsite.com/my-site

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
2844	msedge.exe
2844	msedge.exe
2948	msedge.exe
2948	msedge.exe
4560	identity_helper.exe
4560	identity_helper.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 844	2844	msedge.exe	78
PID 2844 wrote to memory of 844	2844	msedge.exe	78
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 1552	2844	msedge.exe	80
PID 2844 wrote to memory of 4732	2844	msedge.exe	79
PID 2844 wrote to memory of 4732	2844	msedge.exe	79
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81
PID 2844 wrote to memory of 4684	2844	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://emailadmin523.wixsite.com/my-site
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb98933cb8,0x7ffb98933cc8,0x7ffb98933cd8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,9820895149953792669,8863081134471100074,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
caaacbd78b8e7ebc636ff19241b2b13d

SHA1
4435edc68c0594ebb8b0aa84b769d566ad913bc8

SHA256
989cc6f5cdc43f7bac8f6bc10624a47d46cbc366c671c495c6900eabc5276f7a

SHA512
c668a938bef9bbe432af676004beb1ae9c06f1ba2f154d1973e691a892cb39c345b12265b5996127efff3258ebba333847df09238f69e95f2f35879b5db7b7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c194bbd45fc5d3714e8db77e01ac25a

SHA1
e758434417035cccc8891d516854afb4141dd72a

SHA256
253f8f4a60bdf1763526998865311c1f02085388892f14e94f858c50bf6e53c3

SHA512
aca42768dcc4334e49cd6295bd563c797b11523f4405cd5b4aeb41dec9379d155ae241ce937ec55063ecbf82136154e4dc5065afb78d18b42af86829bac6900d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
6bf365340203280ecc92d710157afebb

SHA1
a72cab36ed69360e410585b2f75fb57bf88be51c

SHA256
a6a17f6879cd8da9136229ca41f0cdeec6b8326c5e21fe95eb95e70508473239

SHA512
4fc3aac92ca5b616a258f03861bf9e529edf42283ef0638b872e6a8daad2e2d8f26048908f8a33b90ad9ba2b1af5cfa55d0efc9d5487739fcfbaaeb944d8f9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e98b536f989c7a2d023e72b1afe7690a

SHA1
e7de3206373e20c3c467500b3dd9f6d40df38d69

SHA256
feca77f4dab8ea78658da47b2a4ef5304c1794310df8f118eeb64fd437a6241b

SHA512
9661ab3e6d41765b8e572673d6bb18bec405a1db9403bdc453e946d77bda52a8bde919b6410405404d0c5120922d00477093f64242183fa88373b471c01929a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47ad7f169ba6d9f15ff4e50085d301d7

SHA1
f262410b966c449b63d5610eea766458322210da

SHA256
9fef138fdc880fd19ed68b7cad6c4758db69a8d18e3b2a3635c408aecd9aacc5

SHA512
61c6b328748a43496a4d0143e676665127c5abee8cd90c4ebf797caa3aff61f60af76e24dd4aa9f3272be228a820f6923f2c8b0629ecdf88974c80a5824dcc50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3cab47cb2ab7079ff8e4470303fb749

SHA1
610bc69b34667698441b6df16d68ac1bb438f85a

SHA256
a411bc2daa90d55476a8a59c074fb16721a8615db5fbff2e899dbff9fd133960

SHA512
b86a1dbb953f1f12025d51670e4e2c8faa3e8f054d3c2cb2b19435aee9e7d36bde0c937ff6d9c7f21c95a85f776860031652dccd7e89ee2adf44930e5a12b60b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d3cf897e6b0d7980461703deec01f633

SHA1
17d575bc23290b9e91e0bc7bafb79b023e699572

SHA256
329d0f06eeb99c11d4535f95603c68fb98982bedc951d0cb63361e2d7cc6ffe3

SHA512
c55275d1bec285d7a11ec5942be8fbf568dedd383cce5aa641035032c0013d52a0e6a88af52e987188fe244f8e153869eb74d061fef67c16078d8740b36222e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
80ee4b2d537a4e3f7921f5e8b126129e

SHA1
dacd8a63348de8f355c7f0970b4d6e70251571d7

SHA256
cd1b095ddff277124e1aa10c92e2f5d2270f8b8eedee34bf7c3edd3e47bb2ab6

SHA512
fc76001b87915a7dac91cf5af3f7a3e4e0426bf5dfdf752bf4c8adcaf5e9ef299d2e6995cbd5f5e8d1bb4b43a3ed061d9fca8fe88bac26beabfa1e3a5a4edc90

Download Submit