Analysis

  • max time kernel
    581s
  • max time network
    521s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 08:54

General

  • Target

    http://biurokarier.edu.pl

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://biurokarier.edu.pl
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbce1d46f8,0x7ffbce1d4708,0x7ffbce1d4718
      2⤵
        PID:3560
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
        2⤵
          PID:3464
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1688
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
          2⤵
            PID:5084
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
            2⤵
              PID:4540
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
              2⤵
                PID:2232
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
                2⤵
                  PID:1044
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
                  2⤵
                    PID:1616
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4368
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
                    2⤵
                      PID:2904
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                      2⤵
                        PID:2612
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
                        2⤵
                          PID:4280
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
                          2⤵
                            PID:2644
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9275802308273882194,16389905545400027210,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2860
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4832
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4036
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
                              1⤵
                                PID:5436
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1684

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

                                      Filesize

                                      16KB

                                      MD5

                                      27160ead31b9a911bab1e352ec90bebb

                                      SHA1

                                      19af756dfa8d587d170c259e29d5b6a3eb25ed2b

                                      SHA256

                                      d2b9b310edc77cbe493a0df30c4cdb104b998c233c39aca6b275458165819d29

                                      SHA512

                                      70668c788809976d608069ce5a8dd461b1fb1bd77ceecf5eaff9fb865a42c7f069ace003b70d123ca721f40c6bdb3604cf6fd162fd0871bd682b502cfc4d6b00

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      47b2c6613360b818825d076d14c051f7

                                      SHA1

                                      7df7304568313a06540f490bf3305cb89bc03e5c

                                      SHA256

                                      47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

                                      SHA512

                                      08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      e0811105475d528ab174dfdb69f935f3

                                      SHA1

                                      dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

                                      SHA256

                                      c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

                                      SHA512

                                      8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      456B

                                      MD5

                                      2513a8012a001525bb0f1262eef1b122

                                      SHA1

                                      c607b5628b28bb6170edf221626d7e213d1194c7

                                      SHA256

                                      bc7697ff22e684b031cec9a898f0d3c3188c71a1dffbfd6efde231f7a1dc1106

                                      SHA512

                                      3989b4bfcd3d7d789df2b3c4e0a47f01902edb272efa1ca67f75738de0a92f6b543afc4fbfd199b4c60d5c14d27cf1eef558dfdd1cdad48172353e627a4b2697

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      187B

                                      MD5

                                      b1b3bcf554a532b06f3f335abd3af86f

                                      SHA1

                                      55ef914a0e7b070018842df982e24a004d1ff68e

                                      SHA256

                                      c9d7056b9f0edb3f27914d5e40e4fe7235098895971a84287307e47e7bb12c66

                                      SHA512

                                      607024ac53a908ec4feb087066811ad9899ea9c910c3b84f1313c190c9342289f38316f0e0e6a9cd368791f3ed25019109a0565dd87101ff517f5859914a6a57

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      b0d4218f55e2a9c6610d985c7cac310f

                                      SHA1

                                      34380906f4004a92d2c0543400db6b344ad4f897

                                      SHA256

                                      82c7eac5197daa247b9ab2390ba2309f69d01e026c90a06c7eff050aebf85c30

                                      SHA512

                                      f440befb0c1bc90b0b2abf2e9541d87e1386e877b02d388e8f671f74693109566b3ec88bfc4534c38a423aad486e94ce041a1a79193d48efce7b2fe98c939d59

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      8e3a6a0516d742935d0003f7082748f9

                                      SHA1

                                      ffb20bf5094ea6d952ae47046510873983e795ac

                                      SHA256

                                      2146ab753da19c0ed7d6c6570899c1cbe5f6de5df34013f5ec55160f9c64bc8d

                                      SHA512

                                      bd770f94ebefbc8c005f7f1923fba7053983640ec2db73114d7fcde33752803954cfdad43726b0c020a9fee57232d20aac466e70a2f1041e95bdc7ec5a1dab3a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      c0fc0d5bbf1dca874881e94667daaf76

                                      SHA1

                                      6e90e74cf5252801122611a676e5746e1b3acadb

                                      SHA256

                                      39cf994b127b5f08d0523ce23cd8ad80749c0af439df5ab83afb308776c9bcf3

                                      SHA512

                                      15e6e707dd4f3c5f107b4f676dbfb553a9e1355811bcb77de823e741aeb59add3632924936ac16e19027632783030fd692e1c524d664fe4732e75ee7dd19f487

                                    • memory/1684-232-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-237-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-228-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-229-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-230-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-231-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-211-0x000002C8528A0000-0x000002C8528B0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1684-233-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-234-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-235-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-236-0x000002C85AEB0000-0x000002C85AEB1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-227-0x000002C85AE90000-0x000002C85AE91000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-238-0x000002C85AAE0000-0x000002C85AAE1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-239-0x000002C85AAD0000-0x000002C85AAD1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-241-0x000002C85AAE0000-0x000002C85AAE1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-244-0x000002C85AAD0000-0x000002C85AAD1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-247-0x000002C85AA10000-0x000002C85AA11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-263-0x000002C85AD30000-0x000002C85AD31000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-262-0x000002C85AC20000-0x000002C85AC21000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-261-0x000002C85AC20000-0x000002C85AC21000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-259-0x000002C85AC10000-0x000002C85AC11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1684-195-0x000002C8527A0000-0x000002C8527B0000-memory.dmp

                                      Filesize

                                      64KB