hxxp://orgafarma[.]com[.]br

Analysis

max time kernel
56s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://orgafarma.com.br

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
4348	msedge.exe
4348	msedge.exe
4056	identity_helper.exe
4056	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3272	228	msedge.exe	87
PID 228 wrote to memory of 3272	228	msedge.exe	87
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 3144	228	msedge.exe	88
PID 228 wrote to memory of 4348	228	msedge.exe	89
PID 228 wrote to memory of 4348	228	msedge.exe	89
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90
PID 228 wrote to memory of 1812	228	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://orgafarma.com.br
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9aafa46f8,0x7ff9aafa4708,0x7ff9aafa4718
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3767847354858176666,5457381978393687193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2640816e5c7b8785073e20086c16fbf

SHA1
cc5c959ac6ac980f396f2931cc48d9a5d3a6e5f5

SHA256
8734c68244728ea9474b27cc48f426bb2dc14cf7186d1e15e64f26b92581302c

SHA512
8ce3beecd00f93157f8a40c38f0e11b7fa86a66d7fd0df988cc252c0fb3ce291a27c284ff0eb35aed0850359162692f4c488cd13c556fd2dbddfe2ff36a73e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
76014368f347c8da0e153fc0bdf6eb46

SHA1
4487ce9e5693cf5f5c37193762cdeede746e9186

SHA256
29b9c8cbeb7330e01908fd08bb52b1c43ae4d11f4b52a88ec74216de56f25305

SHA512
5a60de6b451ef1bd2ea3c6d9cbeb18408b0713333a31866bd55843c98645b5fa188c55712c66bc72fce526ee40c5b9fa14056535d59a4704b206184e81e1d7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
599b28f1d191a525302800bad3863dd8

SHA1
852ca0dfa9d141b926c4801bdf067e7557b26a1c

SHA256
f150e752c9b68c33073b1a0369ec29ccd96d0f03170c8b38ed5d7bcf4a016f59

SHA512
09f34e0cda4a7eeed1b25b3c173ee218dacbaf792485922e6186c4ec5916f0ca321a25cbaea7304f27d089e6d1f761dcc031351b2cb9740f0302085be34fd798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f5aaabcc232496007f1a38e151107e2

SHA1
84b14f101ad88b70365adf644b30376b322acd72

SHA256
ef99f156089180d1dee08ebe35abac70842ac29e117ffad45b92fc3644f809ba

SHA512
75aeb1109254bb723bcea93b70a1a11366a198b01698be8038d0ac05f0e2cd430bb6b4a6f270429c58a0a2445e7decb0fb2f50d2363a34ab5246f9532806a188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
d8d87063b537664e3d55f4fe96782d58

SHA1
3f7838b58fc83000fb65e91e5a6fefcbe7ce06ae

SHA256
27784b8fb8a4937d2f6c59d9c36dcdc2f233a6307392e433ca6ebdbd82fcde1e

SHA512
785d98855b0f4f5b566249b0d1cad558f539f4754c919784c93d1f16df06bc5082ed34ebce8f99c8d3fe59758d8d23d39b3091c8d4114887188743cedc7fef72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e82.TMP

Filesize
538B

MD5
0163c095a7dea35e8260d95623508b63

SHA1
7ed3baa811a6dbe3396c6c33b625bdcbfdf29258

SHA256
7c750f7435fb003c3f1a685a3fd271c5c31bc54e6022df1e2b40f982cd239b29

SHA512
385c1f31ad826b7617fd70fe595bc7cad0441e142f5def165cf643b23c9dbc333b02942a2d03d1a549f60ea3e45803a842654cfc458bdd9b164690973b814c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64f17319e04917374da754621906143f

SHA1
147e884e41618ed3be5520257879a6c471391116

SHA256
3170a368004ae1a94c614b4569d4be10d9a41bb86c0b26addf5d4c44aa393ada

SHA512
c0a6fa323fa4cc0c758c5656046036967c7b8c3a385cfb7018d489839f7eff72f424c15b3ab2b22c70b22786c92ca5f64637e2243f3c994a33327bdd310d599f

Download Submit