Analysis
-
max time kernel
49s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 12:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://cica.com
Resource
win10v2004-20240226-en
General
-
Target
http://cica.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4592 msedge.exe 4592 msedge.exe 2308 msedge.exe 2308 msedge.exe 2296 identity_helper.exe 2296 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1964 2308 msedge.exe 88 PID 2308 wrote to memory of 1964 2308 msedge.exe 88 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 1808 2308 msedge.exe 89 PID 2308 wrote to memory of 4592 2308 msedge.exe 90 PID 2308 wrote to memory of 4592 2308 msedge.exe 90 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91 PID 2308 wrote to memory of 3256 2308 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cica.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecbe546f8,0x7ffecbe54708,0x7ffecbe547182⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1476 /prefetch:82⤵PID:3256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:82⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:12⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:12⤵PID:852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:5264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:5580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:12⤵PID:5956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5185615740229732191,15408019869558329327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:12⤵PID:6096
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1304
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD573c8d54f775a1b870efd00cb75baf547
SHA133024c5b7573c9079a3b2beba9d85e3ba35e6b0e
SHA2561ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94
SHA512191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8
-
Filesize
152B
MD54b206e54d55dcb61072236144d1f90f8
SHA1c2600831112447369e5b557e249f86611b05287d
SHA25687bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b
SHA512c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2
-
Filesize
6KB
MD504142dd76fa2778bf9c7ea940552fea9
SHA1b440f6383f985893c565d794a81bcad16aff5846
SHA2560e10227ec060ee90c0858884323640be5520c542a3c38c5da4001a939c2a355e
SHA512544885c1f761fd35da9332ca0301c1a183d8cbd93ec371cdbc3b41974e700a7e1227a94dc234c25f068ec20e7be0cafc45d905bfb2e1e0f551a265f24512f031
-
Filesize
6KB
MD5525e3522457417925d4cba16d18095f2
SHA1b3ae413f2310cf6489a0b8928982a7c2f60c5cb1
SHA256c463ba225a2232414f6e2d37701dccb6739b249caaa45b3c045f80b0f4ae18db
SHA512ba601241c2598eb252277151afc0bed9c5e20aa26b0362dff20192e4215c88b6e68f0498decb422235ac5e91f32730e18d939af958bf5a78f90bf85a22818227
-
Filesize
6KB
MD5a681e0e88a3454c67ce7da7beda798d6
SHA1cf51c6a7ef1277f03aa40a9289e844df232dd530
SHA2567501fc031bbbcb153296e8187d484a7dcc738497212783dba9dbc520d0f0768b
SHA5126c4f5b47d8428fc24866fe25fb09712966b0aa6430ac37afa4df80a9e4e67206de81c419583bf1887f2d81ae20eed941f930ce5d839032ca70f524d9e30d3dd9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f254f272193f579b63d8c508ac36ed3a
SHA1e830e5d8c0e4da10044b333312511af17641568f
SHA2569467f4e24b47eacbd484685f6b70b76b8b156c14444b77bec1530da16bfafb1f
SHA512eb13b12b75bca8246a9fc31a129d6c1cef8c2b5170d11be752c4aa603b47b2563eac2204c98254de5c0cab648ad10c1f3524fde83cc6a39456433c513d325687