hxxp://regione[.]toscana[.]it

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://regione.toscana.it

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3256	msedge.exe
3256	msedge.exe
1504	identity_helper.exe
1504	identity_helper.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 4708	3256	msedge.exe	89
PID 3256 wrote to memory of 4708	3256	msedge.exe	89
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 1536	3256	msedge.exe	90
PID 3256 wrote to memory of 3644	3256	msedge.exe	91
PID 3256 wrote to memory of 3644	3256	msedge.exe	91
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92
PID 3256 wrote to memory of 4180	3256	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://regione.toscana.it
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6f4346f8,0x7fff6f434708,0x7fff6f434718
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,5880981905914236078,9983718261794107366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
222KB

MD5
19e3f7ad0de88f9c8cfb1ee63f898147

SHA1
d4051a40862981d8eae69e46ef2ca62902ee3cd1

SHA256
98e92948c3e65c054f20f8d291ef4c6688165b472d43d1806e90c28d4f281261

SHA512
3d1954fb2b239da3e53e0aa02bb707b4428a7025d1b227bb89177e5616dcfc315149ff68b4a92c878062bfabd644730ddb06aebd31d9f4fd2494736dfb3d728d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
7aa0c4a68ea5cfdea363a30419be0b4d

SHA1
be0b5829b0dc172a654a16097a12de3865fe8e46

SHA256
d854b3979b5c2f9d50c3dd2e8d582646004d34922c364a4de5e643c6567014c9

SHA512
fe7f6d7672a618dc41c95c7a744bd3d6e089c3cf51d75bebef17d392d5cb4516eaee46475523f825c9fb5b296b76750777cc52bfaa6bfaeb165a89e9b13d52e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a153c058dfbc5ec8a20a6153e174c51f

SHA1
de0079bc0fd72d72496a0c2d853f035919342931

SHA256
6feeb635cc0e713e12d066e63d71e0f50d6f21846beda8172847495725904c0d

SHA512
80cc6b7af8a955933c3c128f5759f4c1b5d1d22485a270fac282baaae58ca15590843939f22a6772ba7793f54acb010be7200efe1ffc8da8125a3deb438f0ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f42a419a896d50b3f6fde36f691ae08

SHA1
b2bc09bc0b62c2e7b4be890412c0d3b31d0566fa

SHA256
cd52a70779bad28c98ba002f82c881f8b2febc06d810f00463f5be49e0ff12e6

SHA512
69706f89e2a0fbe0a360900259cc0610abbc6d36db57110cedeb9d21c428584161cee99d7e70ab45bb10eed618dfec421549b96e7c21f12e5d64928120285a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b30bc6a20225ae96c0d30e9d6c110fe5

SHA1
edeb4b786d23dfbbc98abd88ed10ee693913e5a0

SHA256
9f3f3a2d5381894499357b35694e5c17a906ef3bb2e2098bce2f883193614a06

SHA512
e4a35a7777a7fa81a84344176c521f037dde28e1e26e8bab01db8e6644ea0b76779aff5d958f4ff6e2cb3f55ce0c947c62a5f890d76a6d8a9f2ee275b6440052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
61f402d43af4f4c949e5ba7fb746b276

SHA1
6e21c335fc23db131761292f9418d1a3f82ae7bc

SHA256
30314551b0d92a4ef00d434ae52dbd1a0968f6276a3a0800928e8c3f80e2fa29

SHA512
7e313963bb6e0c661e5a6fa2ffe6d8c4a7d888d0278d9b54813664e8a43427070dd15cd2059a2f150581de687903ab23dc60128fe15d21d879387e81e0999562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f8c7.TMP

Filesize
370B

MD5
5cf0fe0286e59024d734d439162a26c0

SHA1
06be6ba400230d537decee445dcdd09feab456c3

SHA256
34cf17d2ac303a8f296f45575f934dac3c6e55c36d26dd900147257d5e0436ee

SHA512
023aff70091410a8b822fa9271a3126c3f333195a60af8c1d0fb4760559359e9807c63070dc3aaa8c7aaa3d5f87c2b6fca97f418be8785d763a70fa8a761f710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cf3e46beaf0ecf06b71ae4ffe19519b1

SHA1
52d56980975b675f6e9c3e6c8fb37e3f526341fa

SHA256
1203f7aae7f69589c17b0af801ffe84a5e236327b8dafa81fd3d02ceba893b98

SHA512
bc90013d0f01b978df2b97cd849a33858208e5847ed4fedefe2242ad554e04829043b3dc8dc3568faa8e6526e4c5923ddf5dffc0e3508df916640dea9451ecde

Download Submit