Analysis
-
max time kernel
33s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 05:59
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dsfghjkreyujykyfgfdg.emma-sleep.info/[email protected]
Resource
win10v2004-20240226-en
General
-
Target
https://dsfghjkreyujykyfgfdg.emma-sleep.info/[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3860 msedge.exe 3860 msedge.exe 972 msedge.exe 972 msedge.exe 2592 identity_helper.exe 2592 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe 972 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 972 wrote to memory of 1132 972 msedge.exe 84 PID 972 wrote to memory of 1132 972 msedge.exe 84 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3316 972 msedge.exe 85 PID 972 wrote to memory of 3860 972 msedge.exe 86 PID 972 wrote to memory of 3860 972 msedge.exe 86 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87 PID 972 wrote to memory of 4296 972 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dsfghjkreyujykyfgfdg.emma-sleep.info/[email protected]1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbccd46f8,0x7ffbbccd4708,0x7ffbbccd47182⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,3128563795960252082,638697275010535216,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5512 /prefetch:82⤵PID:2988
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4976
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD56a4192d2f118ef88d3d37b458e4f554c
SHA142d03d0139bf6a9491521bac0b2b28526f235bca
SHA2568c972b480dc7125e4f39c3bf2af9760a26bb959357825856f9dca87d298ea6e0
SHA5121d3e55315f4ba41cd7eb4d308a55a698e54b09ccd568a4543e6ef977d492eac21baf45e45df9aecf0183596a9c4de7f1096629dc462202c78300faecbadb77c6
-
Filesize
6KB
MD5c0bc88e62349917ff19284f4175abd02
SHA181be0e57e0665236cde8683d1dc8e80599f298d8
SHA256722d80ea9833b2216d627f9e010d5a80cb9f1efca751e20d9eea3bfe09783956
SHA51281b57ae7a939d590bdaf35d659eb88175e3bdf7a67450b56a99505c765c4938c01c0ddc083bd637dfb5d30eeddc91a3dfff90b1e59c14bd0cdcf648422bbc810
-
Filesize
6KB
MD5cedbb7b17dcb69bd1ac2693ea14625c0
SHA1e8ab938a21a2425e742bbeb7dfea6e4c01c8821a
SHA256a76091b6ab51292084b85a15f16c33ae0ee222d87d3847dc177bb5dd33c78f49
SHA51262ce0131a66d0f0b75f6e8f5d7331548a45cd3e5ae3cbb2d0b97226aed28c7c9bc581b1f5ea936f9aea5c665f411ed2edce079b9c20a965055241be5fa9f06a7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d07a0345a8720cc55fab5f18da94f6b8
SHA16110b9ff35f388a1af2136f6ade3d95aaa81c7ea
SHA256e696f71e976bde8899704fdc7665a2be4758b716382f27d2bdce27b81c3af958
SHA512b18b519fcca8dd3eeedd367b60231d0ae81532fa55b5ba80ea863291ce4cdf33f381c69b94792dfc442a11844e1027123d80a527cc8d1e58195625391bfe6a0a