hxxps://envs[.]sh/hWR

General

Target

https://envs.sh/hWR

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3616	msedge.exe
3616	msedge.exe
536	msedge.exe
536	msedge.exe
3192	identity_helper.exe
3192	identity_helper.exe
5312	msedge.exe
5312	msedge.exe
5312	msedge.exe
5312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

536 msedge.exe
536 msedge.exe
536 msedge.exe
536 msedge.exe
536 msedge.exe
536 msedge.exe
536 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 536 wrote to memory of 4504	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 4504	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3324	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3616	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3616	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe
PID 536 wrote to memory of 3480	536	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://envs.sh/hWR
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae68d46f8,0x7ffae68d4708,0x7ffae68d4718
2⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
2⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
2⤵
PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
2⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5554992427870865843,17981165831962516462,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
384B

MD5
2d270a3a571650ba38896d0acf3f1b3e

SHA1
3bbd5093582ff93c15ac09a0e98349030442c0f8

SHA256
4319ddf417b8978e271b70811fe99f78dd159a18a5c67271c6d7d29452bc4afb

SHA512
ef04c253b4a2bcfdad58a809a8d8f15f191edbd0b3558126fbf9f377dbdb5879786080dcae53c48c2dd23d5771ea06664d0ee81a81782bbe2b3f4292964d6ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
867B

MD5
eed66b376ede3e561ce4505ea2ce909a

SHA1
b290daf7ae7f386cdf5839469126268251c02740

SHA256
c871907d308f49a26ba32b2378a8562effb87747b3f24a36064001fc8b2597af

SHA512
8511fd430bd21cba4ae7d41baf0bdc9f458aa78a44864ae004c9bc8ec9fa9baa02b5cc02b41b1dd0b8dab068597db8bd9778122a20fbce5fe62b966cc6216f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
187ff233a1c440b4b6fcfc209870632b

SHA1
97f9c4eaa2e7af20518a7ba5cccfe82d189723f1

SHA256
6b4fa15b12d83279f11c0bf834f636bf9b3372094996cdbc15038f18f63c1b2a

SHA512
f29aca7004b816be335755cc5996fba8e6e9ce199d9d94d0bdf743eb50beb5657242b0d52b85e480036f87f56ae1efa9fde52d3a609ce7dfda355fbc496e8fcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4174c746b1a0f12a888aff811989d13f

SHA1
ff1b398d321404bfb21486189d5200d9d30d03bc

SHA256
0a53e25b3752f01fbf76f774e8be6c00003f07dd0cce6a451a9546117e272429

SHA512
cb5b2ed311cbd3408c36be55c6a18ba9cbb54e2eef0273657aed2c346dd6c44d12dd1bf8aaa6bd5720c8bc9f7ceb6f4718a5d5194cb288ae47d48d74f84bc8bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
0f78dfb67ae42fa32fdf13cce76d461b

SHA1
19e7df660f34ec8ffcc2e4cf72df0ba0bb4b616a

SHA256
f315a7003b1b5008030b8ac6616cbd85cca55caa402b2d5530937c695b5d0097

SHA512
ff2427e2d8f6bfcfb945ca9dd78c0204d802d16b1b4717f962dd8c931d6084e813628d6a161bf02691449bdb32c9d68418a0b70ba767afda53a3a42b12dec60f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads