hxxp://564[.]clrt[.]ai

Analysis

max time kernel
149s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
12/03/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://564.clrt.ai

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2096	msedge.exe
2096	msedge.exe
4592	msedge.exe
4592	msedge.exe
4176	identity_helper.exe
4176	identity_helper.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4224	2432	msedge.exe	80
PID 2432 wrote to memory of 4224	2432	msedge.exe	80
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 1492	2432	msedge.exe	82
PID 2432 wrote to memory of 2096	2432	msedge.exe	83
PID 2432 wrote to memory of 2096	2432	msedge.exe	83
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84
PID 2432 wrote to memory of 4688	2432	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://564.clrt.ai
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffded413cb8,0x7ffded413cc8,0x7ffded413cd8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,14306248404372118155,17216904604428953455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c48e8b68231fb5b2d7f1188b930bc0e

SHA1
1822aef5da8fdd47626fb91afcf79a2be175a325

SHA256
c3b287c29eaa57166b2ab1ba9bd0aaced13cc2f946a04b8d708ac429187fe944

SHA512
2bd09b83e44e0104fbe080a8573690217dc9fbf7fd59ff25a1a9e9ebd2d87ac533f9b99350773d081a7e748b39657115a13e94538b153bceb13ecdfc4672a0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2dc80f5403feb8461b7ffa09890d6a0

SHA1
d5b61e6d672e7e71571e0132e21cead181da8805

SHA256
eadeadba37eed18e5acba408d7e076270b00403fed372b77164577232232428a

SHA512
5e2119529b99b76be105c43714e4b9977ee2147172c1c44e92bd9b41fa7a66f55d4073c864aac668a912aff2898bd216fb38f2fe34ef65de69ad12965218caf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
05e87c336b581c18ab5c37fee51bd54a

SHA1
dba8f8b876a8bbdd8c32dcbc637ebbd22d4c0fc2

SHA256
9083ef044f5a7a9c20f7ccdb0cdeb7684692c790c261114e95a53aa4e6284286

SHA512
9a94c812019ebb0560d6752d7cb7dfb4a19401d527965dd6300a1107c8d8a61686611360c44d914df3c3d61a0adf45f20a034f7a3e372a827564c85c2dd379fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6260cbfa9a831d883449ae137189db10

SHA1
018940532ee08f04ad5e555e9ed8f10063a0fe06

SHA256
51b584035b5d052b7f84d24d70e9ffc76b00a792e77171c34395ad344efdd0df

SHA512
1e5a8c30f1c8912787a995850a09e73e8946ff135777e14a8282e777d637b278f6e258ae5c94c9872229681ed6e1df4e19754606103df481950bd537d559a9c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5696d09243c2d13917dc391b691efc4

SHA1
26ad9615cf5a1b92a1a2e3bec8194e8e74087606

SHA256
68c5875b63a0679a505311eb396e45b93e1a6c805c9c52d8bfcf75d73bf5abd2

SHA512
a953cb2e39f1d2c6b8318ce7ac98663b325f82f1d26bfed4e2acc425eac2da3ee571a0d178640e00895ed427a6fa554ac86540fecfae87d316a97863e7767796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b8273153d17b13415d0b4744a2f036ca

SHA1
56c3066428ab8ae975786aa22edea162d008685d

SHA256
31c1cd890a80eb83d1c0ffd679f198b1bcc5bb622a1e4c3e0569f158d052e97d

SHA512
bc3e23715b998d147b5574b5a4038be2bd3817d0df55a8c875c702fa10c04cd8dd3e4cfc9bb4054848419b15d92822015e6f73eb080b773fc3c4b612aec338f5

Download Submit