Analysis
-
max time kernel
10s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 06:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://8899.pics/ID5115114
Resource
win10v2004-20240221-en
General
-
Target
http://8899.pics/ID5115114
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 2224 msedge.exe 2224 msedge.exe 1940 msedge.exe 1940 msedge.exe 1120 identity_helper.exe 1120 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1940 wrote to memory of 4868 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 4868 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2012 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2224 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 2224 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe PID 1940 wrote to memory of 5004 1940 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://8899.pics/ID51151141⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff935046f8,0x7fff93504708,0x7fff935047182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8822449220707752809,11390621632012811657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD565a51c92c2d26dd2285bfd6ed6d4d196
SHA18b795f63db5306246cc7ae3441c7058a86e4d211
SHA256bb69ea4c761c6299b0abbc78f3728f19b37454a0b4eb607680ed202f29b4bb01
SHA5126156dd7cec9fee04971c9a4c2a5826ba1bb3ef8b6511f1cdf17968c8e5a18bc0135510c2bd05cc26f3e7ae71f6e50400cf7bec536b78d9fa37ede6547cfa17e0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ce1273b7d5888e76f37ce0c65671804c
SHA1e11b606e9109b3ec15b42cf5ac1a6b9345973818
SHA256eb1ba494db2fa795a4c59a63441bd4306bdb362998f555cadfe6abec5fd18b8c
SHA512899d6735ff5e29a3a9ee7af471a9167967174e022b8b76745ce39d2235f1b59f3aa277cc52af446c16144cce1f6c24f86b039e2ca678a9adac224e4232e23086
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5a3faa51723ac41caf7fa3d875caada2a
SHA1ad79e827ea2b6ec59783726e9dd530322c78d3f5
SHA2560f7d43785ca1ac7334dd34298a48d13ecf052e5d1a795c29a0e72527a5d05e3f
SHA512a2367a42a36848a7d495157faea21ea301fda31b6bb13e60f8de154efbd4ad6a320eb333aa88facc83a74ddd4f7ee3bff828f683638f47584de1c3de15ebecc1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
\??\pipe\LOCAL\crashpad_1940_BJYVNGMUOKGXECPCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e