Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 08:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://riachuelo.liderassessoria.com.br/6801576
Resource
win10v2004-20240226-en
General
-
Target
https://riachuelo.liderassessoria.com.br/6801576
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2152 msedge.exe 2152 msedge.exe 4716 msedge.exe 4716 msedge.exe 3888 identity_helper.exe 3888 identity_helper.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe 4716 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4716 wrote to memory of 868 4716 msedge.exe 86 PID 4716 wrote to memory of 868 4716 msedge.exe 86 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2972 4716 msedge.exe 87 PID 4716 wrote to memory of 2152 4716 msedge.exe 88 PID 4716 wrote to memory of 2152 4716 msedge.exe 88 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89 PID 4716 wrote to memory of 216 4716 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://riachuelo.liderassessoria.com.br/68015761⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8650546f8,0x7ff865054708,0x7ff8650547182⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:82⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14809274676470621140,14801556878157313877,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5524 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1796
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
Filesize
594B
MD509ab34c75309a9814ded18baf19dc4c5
SHA11eb48c6a40da7afebdbd5819a888c10df6d4a599
SHA256877148b406c18055b8615e9065c86e42330603e5810e6298ace80ee39d345d30
SHA512658eaadc9be4fc2a2a7bc9625248c89f1d0cb21c38e878f7dcead74cb2196a61c18a4689ebb5186dc8524976d2d9805fd72885f7b99259cd6eee856c386fe1c7
-
Filesize
6KB
MD51f24ad54dd6b9589943fc746492cc508
SHA17d52afff71a11800fb9c3fa1dc1c4b8923b4b1a8
SHA256648f4342f32e55f174c1842ca16a1785c3805eb58db3785258c3e524da016f82
SHA51246794e687d59c0872af7d8910e739a1b1c400ae8fe1261792f3124f34a6f3001beebea6c3eeab54ee24a3f61f3d43a621c1a8344de0469e7264b08e74c13abe4
-
Filesize
6KB
MD5b9d03e4b5a7cb95f5f993f8f3b2d3c0b
SHA14fee71f31648b2278831c1315d222a70b7f1f61b
SHA256179a79d970784546225e38a0ff7b7263ceb25a35e660ac614090b81c70d68755
SHA512bd2e7401a779d1bd8606ff2be74a7b8a9dc3bfd6c721c2d7058daaf604850c0e77453985cb2e84928199cb488c14db35d9c802efd474121d5627f02b0e74d08d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d08f2dd5af6d88239e86c4103798428d
SHA1552c58806bec99d4172e8c0ba473a52bbd14dfd2
SHA25609fe6740acd756a53f7dfb6894698c5e3e5637e4f9ba4a855e4ab68d4d2e1dba
SHA512f241b1ae01e6c72a5798e65b5a41b5ac7e8df6430cb998c50316424eefbc59e3a96b678449176a4756f44f0ce7da50af90728cf41a0cf6a2561398b7f84b83e2