hxxps://sigi[.]inifap[.]gob[.]mx

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://sigi.inifap.gob.mx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
1060	identity_helper.exe
1060	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 5012	2672	msedge.exe	86
PID 2672 wrote to memory of 5012	2672	msedge.exe	86
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4800	2672	msedge.exe	90
PID 2672 wrote to memory of 4900	2672	msedge.exe	91
PID 2672 wrote to memory of 4900	2672	msedge.exe	91
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92
PID 2672 wrote to memory of 1952	2672	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sigi.inifap.gob.mx
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa53fb46f8,0x7ffa53fb4708,0x7ffa53fb4718
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,15522037839147923364,13655118165826984423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,15522037839147923364,13655118165826984423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,15522037839147923364,13655118165826984423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15522037839147923364,13655118165826984423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15522037839147923364,13655118165826984423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,15522037839147923364,13655118165826984423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,15522037839147923364,13655118165826984423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
b24c8dd6daf3d5000eda8927f3965bbd

SHA1
2700955881cc5ae258d8cf1595728e90e3fc4ea7

SHA256
3c1659ade03ace35d2be9eac6930062c65f2198cc8bcfd998a56bdaaeeae8cc9

SHA512
997d14c6bc45fdc10d386d0e60b7e7d565a67d0c8a96fc081f2136ae235d5cfac60bec37805ea0c896940940b05146cc8987348cbcc94fd663dbf6b060466762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
581B

MD5
16c34a365dac99b871a3e910ff70750b

SHA1
1b81bffebccc4b6262de0d35e6bb06cd14518761

SHA256
68a51033e06da15d2c81ab77bc8c487d51e149faf387eb82ed213d0935cefc10

SHA512
8304dc6c4d6e40c2c0328bf0d48385af53e9d70eb8a958529454b8f8b808ba66f04d9ff96887639d7ee7ba3c10bfb6c08d1566059e509a48b0e2d2fb22ca0ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26e165a090006499939f0d7dbe9f01fc

SHA1
45b9d6c392c54d5daee8406f4b2b4778f04c67bb

SHA256
fd7729fccd8a1cb33ec1393012194fcfe378fb58a74904ce5c29f63b7698ecbe

SHA512
9051ea4f18759ab049325a9de6cb65c09f401a1f6e930e2f800cf93efa909854005205d816489e6f543dea30f84778a71037af5d32289cf0a28ac07373589d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
856e999f9b713ef73d1db64df83bfc06

SHA1
1c1862394e5f5ebfb298ff9373bf55ad053efbae

SHA256
dbf4a7c01f13a9465808d492896494f721271903541e0f0d30a44bbb78c0eafc

SHA512
d81607feb013bc0ee4c4ba09eddbd137ca74d48bad3c8ae8ec1b7a8597fc439c2b66647150cd56ac452979fa81a8e1302925e723a48c9fea46de7d1a29d8fc2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd7a4961097a36fc0dd833d7999b0063

SHA1
dc4a2628deb04818ab1c5bce229438d1dbc6377e

SHA256
4aa641d0d9f6f4607624f9172afbb24f691483c39a06f95b16883326135711d1

SHA512
6ff58a8344fe646295e7d6818cb2aff92518d14a307befac3060bf36ec62596db97d436a38d89b14191e573ab3ab5b82eddf792d611204891afe29f01e450383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b827ac91bda1dd0686efa4feea3bf117

SHA1
996cf8f6e0f2b3ff39a8e6ee0c2be0481666ce53

SHA256
e1f17ed16bf5845acdc08d50c099246c1e97b766e346e4f8f2d0d5e71a999f4d

SHA512
0f309123926df7b0c32bdb4de4afb45d05bc91046b0dc502ac8037ae4733a0517d00441a82105fce46e5971ba0df37ac0d4bf8cd3ded2733c3eba7e7debb23f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5d955a3ba750ef94367ed19f76938c61

SHA1
227cf60fdb4135add47d710198882f9e84b73f4d

SHA256
2264d46632b927f8b1dc823285f6c18a8b2f04ae8d7623f92956ec4ad9724c8f

SHA512
42214ae713657cbae5e2ceff1d49edd6bc7050a1a22137c04920adcb4c7adae2a5f8f6ac376a6ffc6c90290ba6355cdc5f5b754214d8656b9e8ed9a5529d0f31

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit