hxxps://pub-a663bc068e4e4f3eb9ce3a0f257882c3[.]r2[.]dev/file[.]html?apospwiidkhjljhfjklbcslbvhbabvjabnjnsharepoint#test@test[.]com

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pub-a663bc068e4e4f3eb9ce3a0f257882c3.r2.dev/file.html?apospwiidkhjljhfjklbcslbvhbabvjabnjnsharepoint#test@test.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4940	msedge.exe
4940	msedge.exe
1244	msedge.exe
1244	msedge.exe
4064	identity_helper.exe
4064	identity_helper.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1244 msedge.exe
1244 msedge.exe
1244 msedge.exe
1244 msedge.exe
1244 msedge.exe
1244 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1244 wrote to memory of 3104	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 3104	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1288	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 4940	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 4940	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe
PID 1244 wrote to memory of 1612	1244	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pub-a663bc068e4e4f3eb9ce3a0f257882c3.r2.dev/file.html?apospwiidkhjljhfjklbcslbvhbabvjabnjnsharepoint#test@test.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffbe93f46f8,0x7ffbe93f4708,0x7ffbe93f4718
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
2⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
2⤵
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16564217768295001667,17531251425925971377,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5600 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:744

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
9cbc4bcc2ec723300fe362a019ffcd78

SHA1
17e55141ff0fb9217199a936ada397430ebbc947

SHA256
a3200d80a902baa166a7ec228dee6047fed783ebf1d63f590ae8b03e7d2a8589

SHA512
5ed0381a69670348c1a6b0572b31c450a37e43beeb3435d903964ff6cf14c344c749d1ff544cf29bc7f5b58e1c1c733c464693ca7ed34c8265bcb5138e8263c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
392B

MD5
78efd976f7d96631788ca8e7b34d14ad

SHA1
72725a47a82ae7e375b5ff53773263e0cf0a3ee8

SHA256
9e9b4b3bfcb92288302561b21ad6fbb00f9396ccbb95c06cdff133a037f31001

SHA512
24030e422545dc92c74721428b925f23ea9d173254a5b1c96dff262090deeb261c371a2adbd0abec7315826cbef420418d2adc105135bdb3e97ac8d8a61e0177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1b3e4f629977dc5bf21017692d911d0c

SHA1
24043e90087721e0ca00f6a8249908e64f4a8727

SHA256
4b93088a310fb9ae141e8dfcbced0cde810b0a350f810803ff711aa3e54965fc

SHA512
44fed9e8db413fbb52755fe567765d8cc3747b933cf2a3262105b1ffad5487137e77e3ec1cf42a9d4a51f1789e9dad646d48e8a9381630d26793969ecd39d291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
00585e2fafff2f1bb422adbbd41f02d1

SHA1
e5e4d1251636894ef2c2aa7ef848af8f6a1cb399

SHA256
e5a62cc2a570296a49162769dbdd1ddab16e9da2910887cc0934f82960f63bd5

SHA512
f65b3d44a6710ed4a3ac9635e860cc3974e546f54b416e6ec87074a5a4ee337e43134383715c2b2704570551ecbf3a1230593a29fcaa5097b7d2ce2fa6a31b49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
85c0bf0d833895d43c1d6bf2e17f9d8c

SHA1
35587d6265a6b9352c5a6599057a750c8c673550

SHA256
3ce7472d91ec0c7210003c66b2861479fffd65c3896bfab2810ff84fffeaccf8

SHA512
6276ef51a0d9f07f1219f495f2deff158f39874b171fa8d887f7109ee4171821e1f691714c73e2133adc483632ceaae3024ebb54f385c14d8a1e30c6d3f67285

Download Submit
\??\pipe\LOCAL\crashpad_1244_WJFSOHOPMQYYSQPX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit