hxxps://dev-banrurappg[.]pantheonsite[.]io/

Analysis

max time kernel
278s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dev-banrurappg.pantheonsite.io/
Sample240223-rasv3aaf92

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2792	msedge.exe
2792	msedge.exe
4660	identity_helper.exe
4660	identity_helper.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2148	2792	msedge.exe	51
PID 2792 wrote to memory of 2148	2792	msedge.exe	51
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 4924	2792	msedge.exe	87
PID 2792 wrote to memory of 2556	2792	msedge.exe	86
PID 2792 wrote to memory of 2556	2792	msedge.exe	86
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88
PID 2792 wrote to memory of 380	2792	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dev-banrurappg.pantheonsite.io/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3aa746f8,0x7ffa3aa74708,0x7ffa3aa74718
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,18101044105971191560,6501270403399605228,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a
MD5 3bde7b7b0c0c9c66bdd8e3f712bd71eb
SHA1 266bd462e249f029df05311255a15c8f42719acc
SHA512 5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166
MD5 9cafa4c8eee7ab605ab279aafd19cc14
SHA1 e362e5d37d1a79e7b4a8642b068934e4571a55f1
SHA512 eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 198B
SHA256 89456db678fbef89bc84747924fc149de6049cb108d6446dc88ab8e74f79a294
MD5 b0a932f5ada4efe3b8b844c368f8868a
SHA1 18487f25383021979409be304c5bfd51f342de83
SHA512 df3cf77a84c3acf5762a97967467e99a2da47afaf5ea49670c47b39047065074924f4ab5abda6ceaa4d1c6d90e53ee314f16c434e3dc5b2d00f7cdf9523aa726
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c6721f8b708bdcd11343d81dd76b644d10539ffae2587e1102029866e1af9f7b
MD5 3df7a50afac7de48972eda8e1887a650
SHA1 9f7c2a0be6aa0d1f3c7fb50cc883f7240f143e09
SHA512 c45fd605447356b9ba8984b8ba2934b21c5abe6c722b876b25c19e0e64677e038c689c8e2ec5a300181794885bfbfcd5afb9e367113fa7bb0f04c2580eeacad2
SSDEEP 96:nYkPSxm/FQYmqQ01LvcRwpvWMoiVmdeHl1tGXrMr3UWQyV+VD7ziEwb:nYkPPOiZv2GWMXlaXAbrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cac63dbe4a0e9b2ac4ffa8d2b51dd18af406395e8fc0793884b8fc80d0cf3359
MD5 90b582acc623bea3b5a8102970c32b42
SHA1 3d6005c3aefbf710a3cbe361347dcf10b43b5035
SHA512 58f6b8ec9e78c8dab07bcde00cb24f4c389a424e962ab3ae02040accf60b2012ae6de63370f728a4cebbd9fa0c2f21d6c2cec7354897f8c1d846f58ec7381bce
SSDEEP 96:nYkPSxm/FnmqQ01LvcRwpvWMoiVmde4uX1jl14GXrMr3UWQyV+VD7AiEwb:nYkPPAiZv2GWMIuXhlzXAbrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 83a8c682b98e74fe014fcea5866d7326d5b8b2f4d59f77f5e6887f26dc3f05ec
MD5 b5f9585c1f56972772f467124c2f3fcb
SHA1 459a3bc16f06258e5823e4fc89c0362b8290a126
SHA512 0aff09aa364d7a586d9bf8f5ee4981a5564c52a0ac2e983000a38c2947329707ccacca0701f6d83c3e1a9eb635932b64f6c4ced6727094f6fe696aaf5819191c
SSDEEP 384:A9iIxuERzA83h09RZxYaA5M99E1MeuBOhU3+:rIxuERzA83h09RZx99TOGO
MD5 SHA1 SHA512 SSDEEP

Submit Download