hxxp://panel[.]alhambrapropiedades[.]com/sublimepanel/phpreader/PHPExcel/Shared/Escher/DggContainer/BstoreContainer/BSE/service[.]php

Analysis

max time kernel
242s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
15-03-2024 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://panel.alhambrapropiedades.com/sublimepanel/phpreader/PHPExcel/Shared/Escher/DggContainer/BstoreContainer/BSE/service.php

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
336	msedge.exe
336	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
4848	msedge.exe
4848	msedge.exe
3684	identity_helper.exe
3684	identity_helper.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 596	3892	msedge.exe	77
PID 3892 wrote to memory of 596	3892	msedge.exe	77
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 1776	3892	msedge.exe	78
PID 3892 wrote to memory of 336	3892	msedge.exe	79
PID 3892 wrote to memory of 336	3892	msedge.exe	79
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80
PID 3892 wrote to memory of 1352	3892	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://panel.alhambrapropiedades.com/sublimepanel/phpreader/PHPExcel/Shared/Escher/DggContainer/BstoreContainer/BSE/service.php
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcb8ee3cb8,0x7ffcb8ee3cc8,0x7ffcb8ee3cd8
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,8340762893358880269,4115660239983743584,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0407c5de270b9ae0ceee6cb9b61bbf1

SHA1
fb2bb8184c1b8e680bf873e5537e1260f057751e

SHA256
a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd

SHA512
65162bf07705dfdd348d4eaf0a3feba08dc2c0942a3a052b4492d0675ab803b104c03c945f5608fac9544681e0fe8b81d1aaca859663e79aa87fcb591ddb8136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ded21ddc295846e2b00e1fd766c807db

SHA1
497eb7c9c09cb2a247b4a3663ce808869872b410

SHA256
26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305

SHA512
ddfaa73032590de904bba398331fdbf188741d96a17116ada50298b42d6eb7b20d6e50b0cfae8b17e2f145997b8ebce6c8196e6f46fbe11f133d3d82ce3656db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5129766e4a353384df456fe0c80ee28b

SHA1
20b92fe844e3008ddb4dd1edc77d5a64a33d1e68

SHA256
c48efd1853e39322f6ff81f7194068b64954d5f85a87c2b20e96bc4b0731181b

SHA512
e82af8ff22e13761925b80c107394068ec7265d20564041aa70a533d545573fc73d90c272fefe7852c7bb1c4204b3e73ecad30664540f4b8bcc4386729667904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd21fd8192e81648528fdae79eae599e

SHA1
bf0964606d23d7ef882059562a6c880973c84569

SHA256
bd8c4e042b1ff28d368f167a21151dd6766385b6b283aaf0fe1d732fdaa92377

SHA512
ef25247c5636e8cd207f3d854c1a7908b0a65211347c09b741e88c245658edd6a9ffc7241ef0d050c03332e5ff9435d7761547b05affacc93d9f028a5bfba253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7da47722409f1419ea851dc94f49afc2

SHA1
509586e88738d558cd141a6b1b5a6480d7d10e8c

SHA256
4685f6ab285c13c1fc8c3179f01c87ddbf1d432341b7fd88a4652cc818d4e750

SHA512
0276ec377a2a796c902e5f526730724e1326f2fab71f0808be11ef1917528c2b54e5250d8a7783f7ceda471ce2739699737c264d67b9a634163ef38bc9614d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5fd28551ee24d4f301e444826c9b5944

SHA1
d3a83c825ebcbbba1915c7aac68c7a6d9e010375

SHA256
d9701c15f72864e63ba084fcf8dec91a61c3ad23db2da7c6ada09fa2b4b68fd4

SHA512
dea5aa6b6cd462dfe50cad28b2e92099caa53090267b477a1003357edbe114120adf7e5c33e423ca67dd5ab2c435a041dadb1fcedd2311db86a90725748d21a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bae14db642dfe890839fd695e5f69567

SHA1
507c98f28a8c4f794e67863e790b7f5007f3d227

SHA256
0b9a9639cb4c8ad4939226872a049d85113fc4bc1c3ad89694774bbc1cf0ef3a

SHA512
2f35132e7a002d5626a58f9a6949819d5a3883f22675cd3b811ea0b405ec783fe04d53e684b5085527270fa6afd1ad02542425c4e54770b13b739437fc4a3fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83776c113f7cd0228196f4851033c842

SHA1
38178a9f9dff238ba17d25bf18edb0368c3c4514

SHA256
112023ca80588c007dd1c4b9c8ee88a304549368f6a8c0300601a679d2993dca

SHA512
5bb882941af6080ae05874382dd970cd262719fc4b22d31aa2b0a40e11fff58007697e477f5db1274396f1c4e58d5e4a80d6ea2a8692ab3b85349404e8b1eb9f

Download Submit