hxxps://www[.]redondos[.]com[.]pe

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.redondos.com.pe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
4724	msedge.exe
4724	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
4600	identity_helper.exe
4600	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4932	4724	msedge.exe	85
PID 4724 wrote to memory of 4932	4724	msedge.exe	85
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 784	4724	msedge.exe	86
PID 4724 wrote to memory of 1856	4724	msedge.exe	87
PID 4724 wrote to memory of 1856	4724	msedge.exe	87
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88
PID 4724 wrote to memory of 3972	4724	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.redondos.com.pe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8232446f8,0x7ff823244708,0x7ff823244718
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,4808709833755606775,1044290487844646419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
18d432872b5b0c9ab847d7d8db19d5ee

SHA1
d8adbaa5fbafafab73d61f419ccca91d2f17378c

SHA256
75bab02e4c02ec30ab93c5e1bd5a1790943e75c6174913e47429e8efe70402da

SHA512
eebf652150aff8fe53c4edb50145c8283d3d1e3bad0a0b35a6a2c623e3cec6a53f4a2e5cafb80cbef8c348838191f04b40958d1dd97a20ac7270f055c2874460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6688802d91ff54cf481729472d03f560

SHA1
79e5c470057b1208157b7301cdaf28737c1dee6e

SHA256
88a475a4fe688a0b31ed33942d5b1ad68e52309dd20ee57f9be2767a48ac2084

SHA512
d67cb62286cc59aeec5c81b407730ebf8ec64bf9b064ff9a2a10178d52ebaa7896d731720879115910bd96c3887aa7a877ced4a2b03a62291e460e5bcc6ea33e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dcf2b93e48555ef7280cfe1068f6c921

SHA1
3d7f3f503315195cf619afe8b7ae0deb6b686bf3

SHA256
8c9fe6c699cb019e6c7d3bfd81369c5876f96cb0e139a4979aa77f9757473118

SHA512
07616bc99ce723d482ed9026325c0665a5a07420f25716f58de8734951eccdc51b182b03e1fbe2e9a53c88ef1c64af16de38d20b69f7b318b6f2dedc3c5c3cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9246615a4f14ed3427e3e36825c969f8

SHA1
a59020a97793c7b4931afac2c7a4451f20f049ee

SHA256
1d4a21de95607562351e909139235d0c9f101af11e5d0592d4745595018ac034

SHA512
adce6bcfa30de86639bbf11f429425fa191a302adf5a332c5182d96c3b05d9c788a22bab825c420a0bcc190c320103468901d9a53f48cb0ccb5ed81f01770b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc1adca9bb0a325b98ac03f3ef127cbc

SHA1
830b7126f6c622f4a596bb662dceb044e1801be4

SHA256
4192d7a4f49ae44a0d32919ed594bee2b36317cde45d2fd85d99b0da1ca79c76

SHA512
12bc42bc5bc00c6046a932c462888639f8f2ad5f0f71e38b1d2f03ce111152480d63a12432f3d6f4e4880ccd9d2b36bd1e7ff30401a0c92adf7cf45d943a2002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0caaf2f852b5a8fccdebef4bfbba1c5

SHA1
2a4ca75c28e9fdeb76eb150f50431f581258c2ac

SHA256
554aaab1a2e760c8c38c6f2972204bb1c1ec52f878533876a28f6e648129cbe2

SHA512
ab4d84d9483e668d08ebd3976c5e845af9f0c5bb1fad8efec80a5761209bf4189f19d7d89b45e031b005696904e590fc2e3a5de3662c86b35aaf9b39e92fe7a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b4f0325b01828515eae5bcd70459e76

SHA1
089a94f8c18dace6f6ec3d0d114e035fc6348aad

SHA256
29a68e56416f6330b1117fc418f34fcb7f97a0fea5bfdbb47d6addc411b43799

SHA512
659bbb610bd7bb28fc69b5213c47724f26e843c6354adb2d60189a9b0f90532674db806d15d106b4348bbab0dfc94084e790052eaab06cc14054bce8dddded9a

Download Submit