hxxp://lively-field-041ebe110[.]4[.]azurestaticapps[.]net/werrx01usahtml/?bcda=+1-888-261-8132

Analysis

max time kernel
121s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://lively-field-041ebe110.4.azurestaticapps.net/werrx01usahtml/?bcda=+1-888-261-8132

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
1880	msedge.exe
1880	msedge.exe
2608	identity_helper.exe
2608	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 4496	1880	msedge.exe	88
PID 1880 wrote to memory of 4496	1880	msedge.exe	88
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4648	1880	msedge.exe	90
PID 1880 wrote to memory of 4044	1880	msedge.exe	89
PID 1880 wrote to memory of 4044	1880	msedge.exe	89
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91
PID 1880 wrote to memory of 1280	1880	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lively-field-041ebe110.4.azurestaticapps.net/werrx01usahtml/?bcda=+1-888-261-8132
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff283846f8,0x7fff28384708,0x7fff28384718
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12593329813046218476,4684793400657716808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
  2⤵
  PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
75b40774e0b7002477a29129a3433973

SHA1
7627f3d239865a177effad1d6b33cb3b43ced51b

SHA256
af9fb9c5385039a4fc10eae380e56923a1f0fb7c9c963decc1e05d4d5cf0036e

SHA512
233501ec8798d5b947cbd20f21f419b42bddfe53c2e85e1e5c4f5e7ab12d44045ff71437fdd1b0a650f257a59ea2513e8c2c1cc226c8b6774f8020a544ee1a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
370B

MD5
a4f9bbbf190689c00f22130f926a5f3a

SHA1
b92f742eff59005eefe319586ae0440ead6e4764

SHA256
1d5c90c924da264a27bdb9cb437fd01c68b078648d037022e5e1ef38814e6123

SHA512
518971591ac6649822f55af253f26bcbaa83998296763627d52aa3f3c74c9bad940221e42210f9cc546938d70f638e1dcd853a523b3ac1b626477d6b4c16d508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c90c0b9282371b0c47e8633277406c2

SHA1
d0baf436a276f4e8541bd1161eefcb724829c842

SHA256
575eaff92daf3c3dfe6a45688cac2bd4ab85ddac5527af9eff6419b983e8015e

SHA512
14d94ae872cde60df270c7bf91a167875c695ba5681b0912f887485808ea643508dd67b632d3852861f1b77b46b02681d7af02987b970f4ee73e4e13f5691536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5bdfab98ee1878371ff0b95d95c7f03

SHA1
cccd32e7623e0bb5c4aa57e0887033dd1c1b9e29

SHA256
06033b2a67823a27c18aa2a41eed24e149be04e2e7ddd4d4b63848facd15fce8

SHA512
d0c20d38e0f3ab0be9a1c2b1a039617fe8b0531d9bca5d41b30b0e6a5261e43ade7306122b8d7ec04df04f3477e3737a60105227f1f2c47fdf1fa14aca2e756c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bf4e4c6f370658ed65c79f2c04aec3ef

SHA1
099cfe948d8c96be190de66783f03a1d8f9c3fd0

SHA256
f6c9bc8f3ff7053f464163a1ad682c90f07ae5a876567b75610ac25ffa8728fa

SHA512
12cf759332d20c4e493bead85e506417c7aea5453c24a5820147f7ee9e2299f7b47cca616029c930d4bf052ce805a74010c9b0029eb45c81f123fd0160ff8d5c

Download Submit