Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 10:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://envs.sh/hEK
Resource
win10v2004-20240226-en
General
-
Target
http://envs.sh/hEK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 700 msedge.exe 700 msedge.exe 1608 msedge.exe 1608 msedge.exe 5112 identity_helper.exe 5112 identity_helper.exe 732 msedge.exe 732 msedge.exe 732 msedge.exe 732 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1608 wrote to memory of 4844 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4844 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 2960 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 700 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 700 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe PID 1608 wrote to memory of 4176 1608 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://envs.sh/hEK1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c6f946f8,0x7ff8c6f94708,0x7ff8c6f947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,416987030026745037,5637719865708601422,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD547b2c6613360b818825d076d14c051f7
SHA17df7304568313a06540f490bf3305cb89bc03e5c
SHA25647a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA51208d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e0811105475d528ab174dfdb69f935f3
SHA1dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA5128374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD5ac782d934dcba9b04f5d8a76815f3805
SHA135f7ec3d309080bf5fa28c49bf61efea0544d660
SHA256a761970e57f308fe2cefe484771870518283e496e4ad597e4904785d961717f2
SHA51245e175b90a0baaf427df2895bf12b24873e643bc500357d78a7ae346015d47a5b9b09b91761b9eb75cc34860afa8fe6c9d12c0bfe3235962b6885c4dad3d005c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
856B
MD5c8d4cdc1413f0fabb30420b3ba11d4ef
SHA1e4ea23355214aaacaff2c5c9c506d6569c90c89d
SHA256a9daf6af8b008025bb00abdb8fd6c8815801d4d3b6bb332a36f712ab3c29d9a6
SHA51203f8b2be571d1de78d55605d17de059681edf5369f54619dc67881cd4150ef9e849a6ecfc8afd8c45486ff19257694965209615e8e7db04a6522f15972c370c2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD534de0430fef5d6f4cb34527d6c264acf
SHA16a3e58a40b59b9c0de6998d8af87e7e84580406f
SHA2563a6d30b5ef3afaba832c9af4d90afa710852302146bc1870ec436153904c8167
SHA51254e60ea20db369b5421205ca442613e46ee83d32cedaa160df82b80af8ae703d8982074cbbf28625bec2dc9b2c2f42286c55b24dfa1f02e06c546fc384e54919
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD553f832183f4d78a5b086f86819389632
SHA12d6c1aa99557214b85b8ad93a19d5bd9ac35b2ef
SHA25694cad7740ddad4454ddade65d9e8b35ddf07a29bdeafa41d372deadbfe7d9d10
SHA512fefb4a66bed9153313270064e143a5339919aa0f0e521ed3c511ea91ef36395e8f4899cf7c82519b4965c0c14fb93130341c71485243864858a6b59cf2841e36
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c45d4ebf-7ba8-48ae-ba67-fd97eba608f7.tmpFilesize
6KB
MD5ed599557868f2179ec38ce773ca53a30
SHA1620c7cf6bbe7b489ee348f4cdd2614d0cd1ed8bd
SHA25692cdec5b41eafd0e0d92a8881bdae33b2222f6a8b24e30d5bb7752aecd1cfd70
SHA5127844773f3bd752d4bd65b7bbf88d9e7fbf137392436306468e01b41d8dc14738c2b19c05d64e091f6a576d0649cd74ae0e7bf6bf9fd48931bfd0561b49913104
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD58c0c84a598b50174ccb675da6de9dea8
SHA1051709ce40c9b0e9dad4f2a56f33ace6eea276df
SHA25649385e8247b828a8ebd569f9475b9ee9b2d697f7fa28d705533a1e9bb01db7fa
SHA51263b68b7b612f448bd3b3a5891430bdb234c8ae3dd78d51f0833be771a628b03e820bee5a7c9b6e76cdaaa992d2435c170c2b67a453f6f85bf41829c1b6b10abd
-
\??\pipe\LOCAL\crashpad_1608_UAEGRDTECBYWACTHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e