hxxp://ecosuntek[.]com/

Analysis

max time kernel
74s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ecosuntek.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
3536	msedge.exe
3536	msedge.exe
1764	identity_helper.exe
1764	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3672	3536	msedge.exe	87
PID 3536 wrote to memory of 3672	3536	msedge.exe	87
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 1492	3536	msedge.exe	89
PID 3536 wrote to memory of 4800	3536	msedge.exe	90
PID 3536 wrote to memory of 4800	3536	msedge.exe	90
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91
PID 3536 wrote to memory of 2160	3536	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ecosuntek.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab57746f8,0x7ffab5774708,0x7ffab5774718
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,937799487496412607,12273974148883335823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
143KB

MD5
b7641289f2b6a2cdad8ef4c274f0ea93

SHA1
65179deca174291f45b6ad8cc2904101e30684f1

SHA256
be58a0295f2ee5f7250920025f22d31112f55ba56c0722b480e41691e06d49e9

SHA512
1c7781d53e17758c28a7c2ff5b8b66381e70be3a2c50d83842be2d568d45e3c11b9c6e5151d9b21e36d2b984658c101324c47798ca350d8f4ef158f0476702e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
eeb077d56bb1a9c7f651c814c2b120ee

SHA1
11c6dbbbf0e9b1fc4b85d62ca00d6fe762733c80

SHA256
f7c095e636c1cf56a8a34d9e1b1a4ca853971fd4d1473c779d218c6c1c576e92

SHA512
6b6f910925e8fade10471c44777f05cff27bace263b944c97da19851f831a855ef942fcc0ec8e15c23401c2b566e8e561543d164c35390ebcf1ce747427ffa90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a40b4ffbe933c01098cfbfa2e0536b27

SHA1
fa199093471a0bbf046d0b68dca4f92a690ffc50

SHA256
d55234962f877aca28d572c1c35e43e229475a376eacdecc3e0212e74f408a4e

SHA512
4df0410a774be1530c950d80711e297312df54849deb76d89d9b637499c0781a41ade08cf8cab6c60a4c108a59f6ae69f6bba93b046dad61a1171a8a743bf57c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c5be42964ca4c3f3dd5dc9f88aa1a7e

SHA1
a831b1433420851d214a7c7ddb35a0fab7483cbf

SHA256
6c9b7af9caccc266f05ce35c38c791d5e4b1b6375e2b010ce15b9674437bc064

SHA512
b44467dd0a204411cde49e8a2429b465602b247f47a27bda40678474f9cc6ad36f60270652f36016ff5f7de6921010fd29c5be55b27ec401a1e1c4b3840623bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df7bb30804e9a11972201b4cb6b4fbc0

SHA1
3b65a1ad03d0aa0ac91d2bfcc7f6ff9c361d2b86

SHA256
a1814b71fdae81117255c2d211c05c93ed41bb529770b58160ce9e1c2e09c732

SHA512
e29e030cd9d304ffd6ffe5ce58bfaacb70cc64185fa53f5ddd0fb289423295445620221e4007ee9bb2338c332e1d7944f25c8ecf200758d462bc280d92f5bd4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aff32853d08c0f874ae9bb1188d57184

SHA1
f019cdc0ee2ec8c7e9551764f2a9f1bcbabd3e71

SHA256
d071f007feca000641399e8a309f28f71caccf22aab0908b3b8dc44dc35dd505

SHA512
96a100b6eb4a75c0a97117d704e0382b5083fcd7c1cb4ed888046afb8f3dc57cd94c1d6dddbf06aebf8e2186d332e73a34ed2cd5eec94ef5c35f3d0aa861a43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c10c0634251a784f29ff3792afa6598f

SHA1
ec7070077efc208fd04f9422e1cc79a674787706

SHA256
1856432211c148b7b62d0cabdead20d5870441977eeb21b29a659e4806c399ef

SHA512
6dac81c352cb1b7989c1f7a1420adcaf315bb8bb31137aa9de2e89adb65362e8cae3c8732bb3b72ecc10b4b765b10d8e0a0bb877e91b8add083c33cd4b539cba

Download Submit