Analysis
- max time kernel
1197s - max time network
1197s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
01/04/2024, 11:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mysteryclaim68.vercel.app
Resource
win10v2004-20240226-en
6 signatures
1200 seconds
General
- Target https://mysteryclaim68.vercel.app
- Sample240401-n29fcaec39
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4448 msedge.exe 4448 msedge.exe 5040 msedge.exe 5040 msedge.exe 4516 identity_helper.exe 4516 identity_helper.exe 3336 msedge.exe 3336 msedge.exe 3336 msedge.exe 3336 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5040 wrote to memory of 3604 5040 msedge.exe 85 PID 5040 wrote to memory of 3604 5040 msedge.exe 85 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 2492 5040 msedge.exe 86 PID 5040 wrote to memory of 4448 5040 msedge.exe 87 PID 5040 wrote to memory of 4448 5040 msedge.exe 87 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88 PID 5040 wrote to memory of 4960 5040 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mysteryclaim68.vercel.app1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff814c546f8,0x7ff814c54708,0x7ff814c547182⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4124 /prefetch:82⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:82⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:12⤵PID:2512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16452384389916290675,11972801104656862275,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5600 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:584
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2180
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3fc 0x4081⤵PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ca641b5-f1d4-4888-9782-4b7d4f357a58.tmp
- Size 11KB
- SHA256 b8d193171554938468c50734e07657b5107fce3034f76f6bd89c015b1b521940
- MD5 37ce608feb83855060224846e2099537
- SHA1 c94569081d5bb548d154de09fb53c2d6421bb182
- SHA512 8da188fb4423cad396ce988ab3161c89418f836b0c026ec479ce3781d5f86b96db6249c38e7834a6d056d7605e743234cb75a4ba8c8a65a77c138b5ecd54d95e
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZYEe2RUHxbXSWznIYWLSDS:A9iIxuERzA83h09RZxYVmRzIDG8d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
- MD5 47b2c6613360b818825d076d14c051f7
- SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
- SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
- MD5 e0811105475d528ab174dfdb69f935f3
- SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
- SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13350a54-4501-41ea-b232-cef0c8be0778.tmp
- Size 705B
- SHA256 e87a45c41f778c96b95f85a1fb298fddee00a0a7efb6bdcfe9a8c3a66061bb39
- MD5 b3750e8eed7b88f4b19a0f554e4d2ad5
- SHA1 106f8a47703d9a27d385b9fb85a7497d909b8a4e
- SHA512 1a80a6ebb997658f604de9f2c6584a47427a7974466f7d43a04c8b9741b941f2795f3fc7486f64f9ec6976ba243bee27e4b1866312b682ce32f06f20bcc2c20c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 504B
- SHA256 832ecefdf4978604ae4b23d5ec182c780cfc3a1a786f7e47516d21b53fe999f3
- MD5 4a5da01a93aabc217f9befaa8e67e076
- SHA1 93ea764bef31a376a7de07cc2d805f0ce89bf13a
- SHA512 ba2be5a38da4a231b449e621623fa727030093999d23189db32f1c52ed3bcef03b47b4567dd2f463d1642cf568b70ad19204a6ac38442d52c2162a005e2c558c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 46da695224e25d4434ed565480871b30f9d1ac2fa09f12678d1b73a9aaec5d99
- MD5 b1e3c8e7cae390a48d154383b29d7a6b
- SHA1 a3561a2f36732dd59e3f0f95db4bc76460d498c1
- SHA512 1870d701c47bf99eea29952531259d78d7f08b7f9cb69b648259d9265ccb7231ee3d46dc4b97e3859cd26218057ffe88b77d5312ff9ea48f0a25593e38ea5351
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 798d09084abd4edd4aca2e58aef5e1a01a1c4eafc9faf806dcc71a5d57992edc
- MD5 c5eab40460c98ec94f1a7fad885357c6
- SHA1 bcf566d8590a17882ee2619a65f3318ced29cbe7
- SHA512 d1142e4a8e885f033ac653a80062a8906162a99a1b8ec8b972fe98fa31026d5dc1b5a0c311c2b1a767416204a300545b096c2ed66ad56f5544e73875facd7885
- SSDEEP 96:n6kP9J1B/0wpvWMoiVmdeH0QXtwUWQyV+VD7ziEwb:n6klJT/0GWMXdtwrt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 158b204dc39ed79287c08d891d338b6ce265d24ad89d38fec27b1db2e49b6a31
- MD5 1aee2ace73723ffa47c6737b15ced105
- SHA1 5638c59808c3d97ca68c2c5e6529b65f85df66d7
- SHA512 59d6f7374931d51520d41fcc09c3a65d9f680c4f6f076295091c21d85c4a57673484601d5e534d40049c90285d0bd3cbf4fbfc271054f122cb31817d6ae8636f
- SSDEEP 96:n6kV9J1B/EwpvWMoiVmdeSuO41j0wFXtwUWQyV+VD7AiEwb:n6kvJT/EGWMiuO4hntwrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512