Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 18:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://qptr.ru/5Izd
Resource
win10v2004-20240226-en
General
-
Target
https://qptr.ru/5Izd
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 3508 msedge.exe 3508 msedge.exe 1660 msedge.exe 1660 msedge.exe 4076 identity_helper.exe 4076 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1660 wrote to memory of 1644 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 1644 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 2652 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3508 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3508 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe PID 1660 wrote to memory of 3284 1660 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qptr.ru/5Izd1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c19b46f8,0x7ff8c19b4708,0x7ff8c19b47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,14595759215452200052,18049194023823412102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
168B
MD5dfc27f946efb2f25f675c5e66700aaab
SHA19546fdb8826f58af4ce7023155b723831dd434b1
SHA2563968142a3f704c08d9eb0ca36d1c09e2364963c2e7b72b60ad09d89aff5a15fc
SHA51209d83a370b0be266e93afdde2b74b202e95827a32f164531b348e23a97c219cc9c30b49fe9bb77a55d61fe54c4cdba0624954c98594abd31c3f10f913f058771
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
852B
MD5bdd6562dd7dbaa6468a44c1aac3d7467
SHA1b9c34c6ef7b48c48ec3369e01ea09985311fde83
SHA256acf5f76f6aebebf839b866f2a9672f6651a1809937f0290d451ceaa8aa806aec
SHA5122ef30749608c965784b2a6fed29351ce1f60f22823e629fca4d345332687a74467cf3a689dea55d822c5eb28362b3406dabc62ef730c8b4e637ccb096d97d8ab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53d2d6455a025ddb39eb65829431175e6
SHA158824ad22d1366f4b7c965fa8b280b89238ca6b8
SHA2563dc76914a3bd6f93544cee7da53b32519a80723893e7be1ff8e0a1c1078dc640
SHA51274df99da484e4b0d10e6462c38836b4e84873784609103689d3e71230dafd3072fb67e1b93684f6a49cbf113c1da24fe83dd356b93b62498777eba7d16b080d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD559c32a8bc9a330c012617c32a7769c5d
SHA1689c9af44249d5bbb82ce2ce5e96bacadccfa9e9
SHA256e66ca265f4c3405ddd0676871c3baadaeed10b70fbccff46903dfebc951c21a7
SHA512c107e658b15966c3e596551718763f9d4d480d67bd66d96d93897f2c7b6805e3b2d516458cd46e342f02ab58052f168c9f0ba9a76c921737cd78a944daf317ec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5849cf4c5348664521fc335e6f977a839
SHA18ea229ee881af311d7682d98e21c93e994bcab8e
SHA256a1aff5124bb0ba725669cfbc0cc883fcb7f8e2c41efe5a503fd04c7157d92734
SHA5124646cdd3cd289e1c1c56e84cf04c245ebc5b448eae0153bcd147daf47debd435ea43460116bb63a0a73a645e5010df91f219306115593f7f5b1c10a9de021679
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5453f14759135f4aa9402a6edd4e75f64
SHA1c89ff4debbbb206a7bbc9834355cc75b46887e1c
SHA256646a2d5c41dcb588e281325997034d5bcf7dfd69fccf4f4e5a233660160d646a
SHA512fbadba5d724fbc402b791eef20a657ea697da9e85972e9e70407e19ea005bc5de7e68500a3b59208652682492f704de49854fc8a83062f174e931e115ebcece2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bee568a8-c144-485c-a1a0-0f81e79a1f2a.tmpFilesize
11KB
MD5dd164e6eb7a67b97424db69158369d65
SHA1aa41d60b2dc254ea7b7756586c5b4e85d282b465
SHA25637c41cf4e7c218f79cfa3edb37d2e10aeb61ed3518f63f248a45001b17d208dd
SHA512d7d628b685a0cf4509b8d4ee6ae49bf5f7fbf48fca66b94425a0893635c099b889a29e3afe071f944b27b8dc5a07da21b88a43544adfb9ed1242424d2b2ecbee
-
\??\pipe\LOCAL\crashpad_1660_IBOWOPVUXOUKEVNTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e