Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 18:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://pbsnova.org
Resource
win10v2004-20240226-en
General
-
Target
http://pbsnova.org
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3552 msedge.exe 3552 msedge.exe 4988 msedge.exe 4988 msedge.exe 3920 identity_helper.exe 3920 identity_helper.exe 2264 msedge.exe 2264 msedge.exe 2264 msedge.exe 2264 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe 4988 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 1528 4988 msedge.exe 84 PID 4988 wrote to memory of 1528 4988 msedge.exe 84 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3000 4988 msedge.exe 85 PID 4988 wrote to memory of 3552 4988 msedge.exe 86 PID 4988 wrote to memory of 3552 4988 msedge.exe 86 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87 PID 4988 wrote to memory of 3972 4988 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pbsnova.org1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad5df46f8,0x7ffad5df4708,0x7ffad5df47182⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:12⤵PID:3192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:12⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:82⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:12⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6842151775755767645,4511966620470083522,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2264
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1776
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e494d16e4b331d7fc483b3ae3b2e0973
SHA1d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA256a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
SHA512016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
-
Filesize
152B
MD50764f5481d3c05f5d391a36463484b49
SHA12c96194f04e768ac9d7134bc242808e4d8aeb149
SHA256cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
SHA512a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
-
Filesize
198KB
MD5cda68ffa26095220a82ae0a7eaea5f57
SHA1e892d887688790ddd8f0594607b539fc6baa9e40
SHA256f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb
SHA51284c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62
-
Filesize
24KB
MD5b82ca47ee5d42100e589bdd94e57936e
SHA10dad0cd7d0472248b9b409b02122d13bab513b4c
SHA256d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d
SHA51258840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD51d67e6d053ad6422391a8e1acd57ae8d
SHA11b6a5b892cb0307da885f109221d4f65927f9d60
SHA2565199332696dc3f8d081377fcd42e2282c8a375ad17f8ae9da8d30e5f2649cf03
SHA512af08b7fc2afa1c9c463d4d4162ebfc28f3db4f6eaa01eb8d3c30ccbdf8f708392bf23a90e02c2187fc8ca0e7d151433000e38c2f9f027ef399d285e07313e945
-
Filesize
1KB
MD58cb9473e7d0abc63cae97c071482e085
SHA1f4f3a5a7a1b2936238b22ef83997516fee871c8c
SHA256c963259adb53c593ec74a5c443a9a43e7f08515c5a3abfea337b4d972299e393
SHA5121edcac99ac014f10d468510b4368e51fe50b7e5b71877d03756b68abe6b21e3d830acfd1f66c9e0f1aafe36244abc5e071f13d342cf9064877cc644ddac3beee
-
Filesize
6KB
MD55cea1e611a6dcfbdeca9e4da3a7e3a8b
SHA13005b37ff1d8dcd8b0ce7d6ea325085d8da6dc6f
SHA256dc858d016b3e92a660ebb74bf00d7eb507350a49aa15a2553502166d8016bb4e
SHA5120a2fda8024b93fe3367e3d6b77bec92ab1769c2a09b9611f66d2f7b7a467c877d85092b15ebb19ae7ffa5216629ab12a90bb20aabafb8cc04c09b41b93122e8c
-
Filesize
6KB
MD5c956acd09584676b2b240e2784f53c51
SHA1acb6513202f96321284e1d4cef268a38310b2429
SHA256545a88c0322b29b37bb2265d6307d2fa452eb23533928ce7d29260e33904a57c
SHA51254f2315cbf74d9b3697dc3519ae22a9dba5f06681cae45a8ff05254b3b0a0556f32778a90f9a73585cd0162af3e4795612ae73f6321cc1de7d04fa2ca57e8f3e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD510c1f9345f534b7aad3af8ec648c7c76
SHA1ae286b8480c7196dd5e548a531994c1a911a9e11
SHA2565dd043a5b791ce61337ff424d6a9df9f4bf35c4ac1785f9cde1b62b4fa4953d1
SHA5129553b89b35a39dac3f63e8e3e7680588a0d49674b70596cc86016358f58e7bf4362569e63286a2cba059c5448a7e3ce0c4d5649051081c83b7c78860b39bb04d