hxxps://www[.]adnet-sys[.]com/vehicles/

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.adnet-sys.com/vehicles/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2332	msedge.exe
2332	msedge.exe
2424	identity_helper.exe
2424	identity_helper.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4636	2332	msedge.exe	84
PID 2332 wrote to memory of 4636	2332	msedge.exe	84
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 3744	2332	msedge.exe	85
PID 2332 wrote to memory of 2244	2332	msedge.exe	86
PID 2332 wrote to memory of 2244	2332	msedge.exe	86
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87
PID 2332 wrote to memory of 2636	2332	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.adnet-sys.com/vehicles/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8195946f8,0x7ff819594708,0x7ff819594718
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,8257577119874115162,3492020291356300668,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
566c96ad4addeb958603cc8a29bce142

SHA1
11d73a9463a65b3f832017d06dd4c116be05ce88

SHA256
00c0d4d75930172192118fa87da3bb49f30169938b08a21fdcc380f32dae62ad

SHA512
6f039fa1ffec0adfc495342d23980d3b8770be7e5b018966fa0433d943821c6ac9fda442e414e97d1b1a8ceeff15e1f5c996e2c2670e8bfccd5a308e8b4a07d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
505B

MD5
f4cab29af95ff7f24f1566379fe11ea8

SHA1
d2221d9606503759cf1d5bac135cf3f6d0cbb793

SHA256
c25b1b342990bc4a2b422aa3ef762ae16c8ac0b8354ba4ae1d0c96181e780d73

SHA512
4f64d78cd30c9886d6e1a43ab158c7d430952ab5c8b7b59930f8b9f73e2cbc4799ba7af96b17d9478ffda3252199a5dc4d095d59b5e1bc9499eb2c23fea10d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44ef2ab7c098b2d503ce6ef07d986b41

SHA1
02b653d2ea7b280649543d952d837e267f2089ac

SHA256
434c85d6a71d6ab29cd7df987088dfd1b6cccbced5415fa8c0e2ff28de7d6a21

SHA512
84dfeebaa4296d18d54202f6ad46eb63f86811c42eee4b452a63804b5d40e9568a0c8d3f39d644a1320321fce56ee60adc5201887fecf782e18791234d08813c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b12ce186d0ba4e846df149e59bd3b8ea

SHA1
48eeac6f287078da4349c577106f769b27239678

SHA256
29d135deda20c24623133292bb3f6f817ffc06a1da8e372c8fd2a4edb5f5fed1

SHA512
0665c4044355dd72208e2ca6c0de5295419e1cc75408b23ae8900f3d051164d20764db1bd13b8cd053034e7eca3bd54a497ab60f81bb229ce18f12902d5966b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
16a059638eb5c02186515b306601a87d

SHA1
4d1c387df3304319314eed79b85c47611372318e

SHA256
80f1b35166701d13fae3cd3333b8da55f895ab6205578c8d6f2ecdb52d439386

SHA512
d07a7f44e3cc2a4f35c290000dc2903f5536789dde8cf7297221289e9783389261a70f266302b79012bc6a3a1c5f26cd7d176fbf3b45c850e3b1cf18ca28fd64

Download Submit