Analysis

  • max time kernel
    1680s
  • max time network
    1684s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/04/2024, 19:40

General

  • Target

    https://makemoneybyclicks.live/make-money

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://makemoneybyclicks.live/make-money
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc72693cb8,0x7ffc72693cc8,0x7ffc72693cd8
      2⤵
        PID:1224
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1828 /prefetch:2
        2⤵
          PID:1852
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4740
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
          2⤵
            PID:4824
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
            2⤵
              PID:3056
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
              2⤵
                PID:4080
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
                2⤵
                  PID:4600
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1872
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                  2⤵
                    PID:2552
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                    2⤵
                      PID:912
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:952
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
                      2⤵
                        PID:3760
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
                        2⤵
                          PID:1896
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,14656105301461529162,9834359824831415341,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1500
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4036
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4316

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  ec7568123e3bee98a389e115698dffeb

                                  SHA1

                                  1542627dbcbaf7d93fcadb771191f18c2248238c

                                  SHA256

                                  5b5e61fe004e83477411dd2b6194e90591d36f2f145cc3b4faa20cf7ae266a75

                                  SHA512

                                  4a53fbbd7281a1a391f0040f6ff5515cedf6e1f97f2dae4ab495b4f76eb4f929dcda6b347f9bf7f66a899330f8897e1ed117314945d1de27b035cc170fa447d3

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96fc74eb-e7bc-4241-a31c-4cd5479640cf.tmp

                                  Filesize

                                  1KB

                                  MD5

                                  a9c1aa01aa078371700ff1bee64b00e9

                                  SHA1

                                  403eb793d7d95c4f974631cbe7ecf007517c120c

                                  SHA256

                                  328cf94fcbb6e3e22777481a4e6d10ef0ec0a2477a0569154126ee0536cabe7a

                                  SHA512

                                  9f1fa4ac97a57b87a8104740188607bfd93fccaaa610bf79790bac5a967236246be807316427251c593858312a30a0f6ba63fbebac9cf69637d7044e65014816

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  2KB

                                  MD5

                                  6c493c71dc88fbe75d5efa553b64c2ed

                                  SHA1

                                  167c9749b8d0232c5095746a0293604c3354d637

                                  SHA256

                                  71a862f87626758b9a675a865407dedebe81b914ae7a91928eda054eb4aab2ea

                                  SHA512

                                  1d87224b970f52edb9b095c2cdc0532454f37050daa4dabeee92cc1f2721ede6a3318bceec9dd84d90729885c8cdef7d575b8438d32271ed586ed50f39398f13

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  266e3d3f634b2b44ed350d07b744b2a3

                                  SHA1

                                  7b27a70fdd77f1a05e88be37e098c5499e1f1b71

                                  SHA256

                                  7f02da987cbdfec7b44176676772b3a3aa62658405a96926ad0037a79ad33d9d

                                  SHA512

                                  840bfff46ea085a74529434b3944c810e1e7386739ff44c9e955949930a4e380eb157ae2a97e4c4a67198df4dae74ed443bd3b43dac9ea92ef7e2c3a4760b46e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  9edec93825f8eb56faafaa29b1b5cf88

                                  SHA1

                                  4834aca63b289e463afc7d2daa554423aca1a2b5

                                  SHA256

                                  90b0c2f5a28c93be64461084ebb4a98861f6f4121e5a75d4ac4de283cae43012

                                  SHA512

                                  c6839651ce64f685ab8821a9864806ef6a0d92e65743aaa4cc9dc9c664958468a8c428b32825d40607a1011173b6cb90ab64e8d65cad59b973367bab59d9d18f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  111B

                                  MD5

                                  285252a2f6327d41eab203dc2f402c67

                                  SHA1

                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                  SHA256

                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                  SHA512

                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  2KB

                                  MD5

                                  3de547696ff1c61abdaf12b07c5bf9e4

                                  SHA1

                                  6095498e7795d5de8d4a278d9dfaf224801fde4f

                                  SHA256

                                  192dd13b9a0e7ac6dc3f496d6991bede0dba9c5b80639d4f75f45449e51bd0e7

                                  SHA512

                                  79f7636c700a7b85693f810309fa1afc686c1789157ab944effe7853b9b229a2e0d5fc93cf5f514e3dfc587a8f066616466df6f624ee6877fa4d3a406052e204

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  4KB

                                  MD5

                                  19ea4b2982942cfb4ccd41082569c9e5

                                  SHA1

                                  1a6cf1176a621a945adcd5cdeaf9a2a67d3c659e

                                  SHA256

                                  3d9c864b96ed76db4b7d56a339084fa0f0b62581cf2dd5c913bd995651ba85b2

                                  SHA512

                                  28719a3602e23dc0857f42d8a6c5adc3a2493960fe4e327fbb0f511bf746fdbfef887191709105cb4ef24d3f04f8d624983bce55cca7b865e02def63a3d49718

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  5d334a5ac65e1303b4373fca9f9dba7a

                                  SHA1

                                  853c6fc41015e3be0766ce58b7f7c179bf93ce2f

                                  SHA256

                                  6e7f5728682ba7d2eeec669b22f0469cc5a4bdf438456ff6e467e949352ba335

                                  SHA512

                                  219340d2fafde7211b00b5abb0a13e5c22314a6bb8a7831887235db0b61b943d76c20041821179aeb794215fb3026d797a7db51d13dca68e6926d0db928465b7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                  Filesize

                                  25KB

                                  MD5

                                  0ba15f72ffb0a37243558588d3e78221

                                  SHA1

                                  814bdfffd723f7de9f8d6d6a0bc8d85a9f275cc0

                                  SHA256

                                  3d0223e1f8bb35870db41872cfbbe467f65bf9a1208dcb4d4ad874e250ccc10a

                                  SHA512

                                  02b168ef9cc226a08955092173c3745a55b28faa438b8152acb90d3bc1d9f433de7d8341def8b452db1986392a59cabc7c69689ad00825c58371ca78021183be

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  e6f4c5e1b337c6561b8a1ecec56512a5

                                  SHA1

                                  00e227de78f0689a631d5c4adc5cd1f3afe45711

                                  SHA256

                                  82157c78863781cb10053afca77400f2f621ef8ac9d92450208476036d90cb44

                                  SHA512

                                  54a1ca4968ac9b9266be7d51b9d31998a73a5a56e02dcdeaae63ed16915e19fe48da24961f2e5dc08f22aeac5d097a13ab7069a4a60b13c4dbc112ad97d11894

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  e4fdbc7304e59c6f93997bd752f115c1

                                  SHA1

                                  7d3f415066dcb9166fbc8cdc25e6e20a840c81e0

                                  SHA256

                                  69687b8e9ef3bf599ecf00c7ab10b0b94dbb626e3203b1ebc7457d8fad59f3d4

                                  SHA512

                                  4f8137455066925bcaf3feecaab2905328f4438775ce68aa829797488a313b14904f2521d3dcd45dfd8f0852c38fdfc2d8ab3392cb583155c16b3d4f70dc2e88

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c350.TMP

                                  Filesize

                                  1KB

                                  MD5

                                  8fb118d59799a3d7d965944fabf309b9

                                  SHA1

                                  ebd8dd5d49a0537568904584d16d920ccf47fcbc

                                  SHA256

                                  a2178caa5f73f040aa4fe2d96da513c8c148d98c00967ff66a7b087e4603a824

                                  SHA512

                                  0293136d06210d0c66e9c4a646bb76edc2945a9b7961b2f199765dad9645d824bce8cd05e70144301dbbbe8b65d27b995cbf177bb63535f67353a156651798d0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  a3d2cc7a9e72aa1538376ef4ec8fc9bb

                                  SHA1

                                  182aa560926f6c92d9cbbb45c92ee255c88e4a0c

                                  SHA256

                                  bb20a6225168b90babac46f1516ff198fdc0cd52fa20712dc143d77059001f7f

                                  SHA512

                                  cb87efd462c83efb003ddca50e8d5605aecb62d767db945837884ed13c026b9d74bf25f6ee5a1c5f0d6376d2e59692166b41755fab6a33c1cf022c42e5e6315d

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  5f20993e618ca313a0a9181feeeba4d9

                                  SHA1

                                  c8b4178913e5741d3e4c3a4133f0b1572d6fa9da

                                  SHA256

                                  1cd4fc4ba4a8fac2eeaf8a989b27f57ef0f9256a395479aa3e49af0cb51cd82c

                                  SHA512

                                  5150caab458e9872a9c411140159086cb40917acaac3c021fc0431507284f5e04a1287dc291d406948846ecdf320b56c9eb374e216eaeb9c1d5c9b115cbbf4ef