Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 16:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://envs.sh/hEK
Resource
win10v2004-20240226-en
General
-
Target
https://envs.sh/hEK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 1552 msedge.exe 1552 msedge.exe 3900 msedge.exe 3900 msedge.exe 3660 identity_helper.exe 3660 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
msedge.exepid process 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
msedge.exepid process 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
msedge.exepid process 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe 3900 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3900 wrote to memory of 1432 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 1432 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 4768 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 1552 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 1552 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe PID 3900 wrote to memory of 3892 3900 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://envs.sh/hEK1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe849146f8,0x7ffe84914708,0x7ffe849147182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13546299801489134949,7903980191083500505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13546299801489134949,7903980191083500505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13546299801489134949,7903980191083500505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13546299801489134949,7903980191083500505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13546299801489134949,7903980191083500505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13546299801489134949,7903980191083500505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13546299801489134949,7903980191083500505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13546299801489134949,7903980191083500505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD57350c335fc91564a7a70ba8e87e63de9
SHA11acd45e877ccbe84ebb180eae450029f00b039a3
SHA256606d4e320324cda80569cd51cf644634cbc6642da4cef8bd63bc096da68ee21c
SHA51244590efb880c8802740ec32157c47b519ee22c23efc8075ff05becd7e9d1100ff26c0502e9e019914a0f1dd0d81be3f814ca3c121a7ebdc8f8be6adf2099b25d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56dde1c494d88a5d013285ebf84de9afe
SHA1158b243b1ab2a157c1d33fbca2cb7d4073746177
SHA2569d2399790d1ba5630dcb259b9a9e8e0f434ccbe7b59c0c55d8577e322b595c41
SHA512fd947f7c722d6234e0154260a80fdfee92d7ed33bd7467241a6439d7b8a7bb08d10d69a5f85e949b2d1af76a59dae5dc6fda4ea67cd3f6d5330216b5362af7a6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5483638d07bd4ce9a609d8cac4d340b44
SHA11d6ebcccdb54aeb6414a5b16cf3c8ed3740537f6
SHA256ba3caac04842734e9061486a90d3ca3408c359437b6886736a67406a3f51e8c8
SHA5127e100c94d1d0fb7edab4d9608728976d25c594096947478d29777b1868bdd0332c904475e09eed69835b20819293276760685b7e5e77ad9c10a757f9fddc37da
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD566f80e4e6cbd18e22070f17371c238d1
SHA15f4486e030c4911a55e5bcfaca7ef807b8f9bf15
SHA2561abe707b526a45c846aefe2b258f5e6fd8aa6a2d308af05e3381fc377736085d
SHA5129dbfaf95e6bf7096e1ec5001970bdb2e2717783343fd9482db3c25cb72eba09536be8ef46f585fa073b9470b03d9c3d498d6cb148a33a43ca3668849611981b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58b86737e143acb72c986be792cf8cb8d
SHA19c513702a2e7dece50f7747d97cce83449d86a7a
SHA256c61a23bf9a1ccd37c72fe6654455dba0b24c1a3b6bc9ca66ab5c04224862d2c5
SHA512b39b7fab39a7d90fd99b8a274530b598cff9ca0d2de938b338818bf44a11cac4b09c07c9b6703b201f525d2238c86392b520f62d0baffc9aa94e0b013f121055
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD58133df72c1af154f2322faacaebc1848
SHA19472460809d43700b7d43897678a484a9e1f7822
SHA2569d0a5dc163a60d526bb0e102a3098be43f4f6de7739da8ca4c1d322802d096ac
SHA5124d68f53f2226dd967332064ba0976aab2d61a7f886049c0a48aae300ed2d56fe115bfb4dc4b07eb78b1aaa44557c80005b4ed51c362639c77a571de438875dfb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\pipe\LOCAL\crashpad_3900_SUSWIMHAKKNCBIWCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e