hxxps://onstream[.]so/#section-download

Analysis

max time kernel
159s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://onstream.so/#section-download

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
4560	msedge.exe
4560	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 940	4560	msedge.exe	87
PID 4560 wrote to memory of 940	4560	msedge.exe	87
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 2168	4560	msedge.exe	88
PID 4560 wrote to memory of 684	4560	msedge.exe	89
PID 4560 wrote to memory of 684	4560	msedge.exe	89
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90
PID 4560 wrote to memory of 448	4560	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onstream.so/#section-download
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8d5946f8,0x7ffe8d594708,0x7ffe8d594718
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16135796819222962030,11207397978273095769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5fbc3dc91b19a0d38b971bfd140e9484

SHA1
26f032d69d51cd481c2f9046a924045f5facf650

SHA256
8021f68e7393afea93f19fd4d486aa8648b0512d5254a8316baff37699d24a10

SHA512
ad272455760700194c3415ca419cc8642e7378091f1be8000c071be78a7bd249b857fa89ce2642772823aaeff5fead758af2663b65767d8f00ef71e95a350b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
930B

MD5
bc3917b0134f8b8211f50127cce126cd

SHA1
0d35a7ac39cad65e4aea4a749e3599ecd533347a

SHA256
9f5047c1e0cebea1de7e8812f8791b801b560a042a0a50054480e2889be63dd8

SHA512
f11951c37335393d5bbc51b41a22e53f205cd47dbe4869039e813284a443d7be240395bfdf818fb18000cff77b1009823d084fd7581f807992a4c83f5d0d4f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14aa29d6ae37d7827e06ca9b08abac1a

SHA1
e11e4ed0fcb79966204221e30742a69cd8690b1a

SHA256
a0661df82692adbac8980ae85426169a24a1d041f32d04afd4c5c71f32370084

SHA512
61c065c9c9cb82bd8f30af547530748d4e92d99ab9d300c4b55935b6ed9e102351693eb62a267d8966a467d850a166bc1b5e0021ab08aaaa5a20efdb655b3108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8843e181412a15fdaa1642a9cbef61fe

SHA1
a0d836d115d72bd593692200a8888154eb77e66e

SHA256
ba6a0c9f33ff734845db9240b6437bd20330d39e053ae565bacc238be910391c

SHA512
a8fc2abec3dcbce399610d8ccadcd1023935ab7749bfccaa873263f84b8297fa2517feadf6bd1b27ce8514eb7c247d330b14c79239072ef17d9238a53408e90d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae222ef31e1c38d162ddc6b14e71a42a

SHA1
41cc7815a52b1ab0701b61c6863029c0c7170d67

SHA256
67e6e3d1a76f4069052e11e7cd9e9853ea09073126e52bb731ee4bbd98a59cc1

SHA512
11e1eb9a82f8c19a0dd8d2e86f08104b260ff3e138b11fb0fb9f5484aa3007b28a5330b70f36290af3c691e63876f6c41b9b702812acd908b6dfc2021335e1da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
479e3f63f22edb7b9c203a1c5217353c

SHA1
e212fc93cea71b65992dad330d97ccb99910380a

SHA256
9d5d29b80a5b15376ae10e1c5c5c1fdf10c8f631cea804596c265a8ae6786963

SHA512
523ef062290323058c7e8570b0b2d628f9de8b09ddea9c4e1f05f108b43323619bbb5f83653898299522d0ba653f686f95965a767fdab5385331d1ea5784e638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
85405d7c8b85c29f7053fbdec6b420a9

SHA1
a7ffcc69b2a2c03fc0abf3ae3cb5ce5a4341dad3

SHA256
e334ea0222824ff84fa6dc39f8d422bd66c3df543979d61d934a49f47e89f0c3

SHA512
4ac9e709e6e9076f4be147605aa56cc8521c00d7b967758f9d139c7cc4745b568845d6ce2bb3f57c27aa32fa06819ef1efb0ec78e304c6417931868e9cc6bd30

Download Submit