Analysis
-
max time kernel
4s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 16:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://softeu.net
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
1800 seconds
General
-
Target
http://softeu.net
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4448 msedge.exe 4448 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 3748 3260 msedge.exe 85 PID 3260 wrote to memory of 3748 3260 msedge.exe 85 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 3940 3260 msedge.exe 86 PID 3260 wrote to memory of 4448 3260 msedge.exe 87 PID 3260 wrote to memory of 4448 3260 msedge.exe 87 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88 PID 3260 wrote to memory of 2472 3260 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softeu.net1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7fffb0c946f8,0x7fffb0c94708,0x7fffb0c947182⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2174204908261570392,11355556670728316651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,2174204908261570392,11355556670728316651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,2174204908261570392,11355556670728316651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2174204908261570392,11355556670728316651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2174204908261570392,11355556670728316651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2174204908261570392,11355556670728316651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:372
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1564
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
Filesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
Filesize
6KB
MD59ca09e5c51448bd79af8b684c396dc2a
SHA1ad2827fe7d60735136ebf6244db6cf631330c4a4
SHA2561d22f28f75f4d7a13c22002f2e4c6bdce9892fad25278b680824c8f7004edfa8
SHA51284465b5e566549353f5befba8b1db5dc33e8d24753b8b8d95c0ae893dd1585cf4b37c7c260d121d6eb14c20b0a9acd386cadb68a44c867fa69c48f1eec2eb8b9