Analysis
-
max time kernel
9s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2024 09:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://superd.site/%22,%22r%22:%22f1c1e07d-e330-4dc7-3dea-547d11faf7a8%22,%22m%22:%22mail%22,%22c%22:%2200000000-0000-0000-0000-000000000000
Resource
win10v2004-20240226-en
General
-
Target
http://superd.site/%22,%22r%22:%22f1c1e07d-e330-4dc7-3dea-547d11faf7a8%22,%22m%22:%22mail%22,%22c%22:%2200000000-0000-0000-0000-000000000000
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 2240 msedge.exe 2240 msedge.exe 2412 msedge.exe 2412 msedge.exe 3108 identity_helper.exe 3108 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe 2412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2412 wrote to memory of 816 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 816 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4776 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 2240 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 2240 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe PID 2412 wrote to memory of 4812 2412 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://superd.site/%22,%22r%22:%22f1c1e07d-e330-4dc7-3dea-547d11faf7a8%22,%22m%22:%22mail%22,%22c%22:%2200000000-0000-0000-0000-0000000000001⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa299146f8,0x7ffa29914708,0x7ffa299147182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,17169243620095067023,9650027516008486340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,17169243620095067023,9650027516008486340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,17169243620095067023,9650027516008486340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17169243620095067023,9650027516008486340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17169243620095067023,9650027516008486340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17169243620095067023,9650027516008486340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17169243620095067023,9650027516008486340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17169243620095067023,9650027516008486340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17169243620095067023,9650027516008486340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e494d16e4b331d7fc483b3ae3b2e0973
SHA1d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA256a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
SHA512016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50764f5481d3c05f5d391a36463484b49
SHA12c96194f04e768ac9d7134bc242808e4d8aeb149
SHA256cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
SHA512a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD59ff19c1b8f432a2bacc39617c846171d
SHA1ef97f311d62d74b409cf977a043452f7c4c5fea8
SHA25622dc93d710ddeda382e91f77ccfd8be9e049e24e29a06430ae9a13400ab409d3
SHA512cb856f2839d2494882b2cf125aab9692b5f8b343e31340bce4f213c4e3066431693055183979bba98a45bb4dee948114fccd58799b87ae4d7c6cb00f5b118de0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
\??\pipe\LOCAL\crashpad_2412_NBOUOSCYYRYHOLVSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e