76928451ea77097ad6f96fda0ee51be9430aa4537b29b853757e76f6ffe8f912

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Code5.de.url
Size 184B
Sample240306-p4mvssbb6w
SHA256 0f0d83c5fbcf1b4e5e0bc51c7e22da25cea1ce686d82697794190099e419e44c
MD5 3ac5958df4f92691f0abf2d665916c28
SHA1 6b2a41d18dc26096d0ff6f87b3c73f86b3e3dd07
SHA512 1d6fe688c4c103e6e1be4e98ddd21b1bc448e1fedcc4b57c996a62739e02451e4bb8a250766f98a5d161aee9fa8218b1cbd960352ed76d7c269ca9cf9ce87924
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
4360	msedge.exe
4360	msedge.exe
4468	identity_helper.exe
4468	identity_helper.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4360	3752	rundll32.exe	88
PID 3752 wrote to memory of 4360	3752	rundll32.exe	88
PID 4360 wrote to memory of 1416	4360	msedge.exe	90
PID 4360 wrote to memory of 1416	4360	msedge.exe	90
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 3872	4360	msedge.exe	91
PID 4360 wrote to memory of 1712	4360	msedge.exe	92
PID 4360 wrote to memory of 1712	4360	msedge.exe	92
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93
PID 4360 wrote to memory of 704	4360	msedge.exe	93

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Code5.de.url
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.code5.de/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4f0946f8,0x7ffb4f094708,0x7ffb4f094718
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,16869223455698780514,6369731065948490154,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
MD5 7740a919423ddc469647f8fdd981324d
SHA1 c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA512 7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
MD5 9f44d6f922f830d04d7463189045a5a3
SHA1 2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA512 7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 da054be8f856c9ace1dd4b20c6112d4566c252e77cb27a4d9f6d592de7ebe888
MD5 2c3aa000f1b4e7c8ba7abb10d503cf01
SHA1 a9d05352616b3c5222ca96594cf5391ee0898ed0
SHA512 dc2297ce593efda64bf38d41cf7a60fdf2a548df0d4423dc33b9406115daaa7386ba5d06a4e59ad4fa5ef9e2b39fbdcd72e7b48a405e102b93b1f967565f9242
SSDEEP 96:nBk6xm/KQYmqo13KIh8lwpvWMoiVmdeH+G5/UWQyV+VD7ziEwb:nBkHTbAPlGWMXNBrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 528dc8cf5c5426d2eb52b80a18ce95596b84a1daa793644d6cf4ff97784c3c8c
MD5 c4169fc066a4639b9543d8adb8dbde04
SHA1 0ae9a6f476219663673e5c6fdd73644066a9e26d
SHA512 1d0c46f5b8febbc19ff2b112c7293626c97c35c782d6c41f51ebf9da787781a550ee01f0504374c1f10abbf9c333f6f28a76c8bcf1c1ab6867f193d4fa812fca
SSDEEP 96:nBk6xm/Kamqo13KIh8lwpvWMoiVmdeEu51j+G8/UWQyV+VD7AiEwb:nBkHabAPlGWMUu5hNurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c7fd99fef3922db143928a9cc6fb1ce1330bceebccc99b723c38457dc65bce1b
MD5 f22695da60f75eccad511c7f4a3aac9a
SHA1 3ffbb9a64a6a38eb7f08cb7d303e59a5d2893a0f
SHA512 6aa9cc457e3754cd07f712e061ad00ccec57ccd51adac68404156524ae09453565751616816c2d7d50d80e362955605a9302a6c7e1b2a8e9bc1ce7a43c84ff10
SSDEEP 384:A9iIxuERzA83h09RZxY0i/aDiZrctlUxC2i:rIxuERzA83h09RZx6aD8SOxC2i
MD5 SHA1 SHA512 SSDEEP

Submit Download