hxxp://austrtax[.]com

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
25/03/2024, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://austrtax.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
4280	msedge.exe
4280	msedge.exe
3332	identity_helper.exe
3332	identity_helper.exe
4828	msedge.exe
4828	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 1576	4280	msedge.exe	78
PID 4280 wrote to memory of 1576	4280	msedge.exe	78
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 1300	4280	msedge.exe	79
PID 4280 wrote to memory of 2724	4280	msedge.exe	80
PID 4280 wrote to memory of 2724	4280	msedge.exe	80
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81
PID 4280 wrote to memory of 2256	4280	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://austrtax.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd60d13cb8,0x7ffd60d13cc8,0x7ffd60d13cd8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,10894678985540548642,11321042278025815830,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3504 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3b1e59e67b947d63336fe9c8a1a5cebc

SHA1
5dc7146555c05d8eb1c9680b1b5c98537dd19b91

SHA256
7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

SHA512
2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e10a8550dceecf34b33a98b85d5fa0b

SHA1
357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

SHA256
5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

SHA512
fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
933d46cde0ae5fca868df18027485bd3

SHA1
93bdb3f86c9211bacc949a1393b1ab62eb06fe42

SHA256
a7ac59938f00b2b2ed2c282640968c6d761c30313ef75f323719de499fb1cc6a

SHA512
7fd77d59bb907bbcbc46d2827a85283692335dd749d38166fc90d26d5100b55cfc446751563057e2538be790ab3377218447f4bfe501ec435669970829ec6fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
546B

MD5
b79879f3c80e0a2a03efaffee22409ed

SHA1
2bb6b00f87bd52b514171da192b50890f05956fb

SHA256
9f28661e9cf5d968df26f3caea5e3e274f161496514e53b071b78d424f87b3f8

SHA512
00d2486dbebb6bc715126b3f6a3542043772de51301eb4ac435f845d9f4026f3e1ba51bf6b295d84a33911af367febfe59d3314968f57f8c624f0b8830aadd49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5efbd44d24912c861d87df52bfbfc53

SHA1
13bb4454e72517a9744ba780cfde4c33043c2406

SHA256
cc63a9e30c2e0ef352a40b577f08cda4fddfba8a81e751d0aaf918bb18c9dee0

SHA512
5aa824cfb329d334e2a09374ca1635ceb9224a93bbf58c1373f1541d8a2296d397b124827c7c84670e1c99f4fab2efb7be10d4cdf1e0fba8d39ee50128a1341a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be10f9e2c0d4fda610da0b54aa7a5cee

SHA1
484360b79c90c43f65da55925889646ede8bac9e

SHA256
5c9b5ea9fbc9dfb78b271945d013d5e77f54b7a693be754d377bfe411b6a9ccc

SHA512
2119064c11baa7373bb5a45b4e658bc446515be4c51669e4d676789656d3a9d58a0b1c793bea5c63b40b0f3521d7240c69f410b1635c29ef3f047ea66c61abbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6e77f8df1e566d6690b9018f245feeab

SHA1
0c401adf1147b89e6fcf950dbdd98578637a16ad

SHA256
5090726791849b64310c71ab456280b5b3533e933b9a8038c8b2a94b60903c9f

SHA512
703fa7ce0b2d92f0088a492d8e69e4796bb1be2900ec2135737e4ce95d26efe542628bb4c0789d5a6e82c09c813f966e0f9d41d172266336826bb56dad6b7caa

Download Submit