Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 12:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://qptr.ru/EDcn
Resource
win10v2004-20240226-en
General
-
Target
https://qptr.ru/EDcn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3284 msedge.exe 3284 msedge.exe 3596 msedge.exe 3596 msedge.exe 3380 identity_helper.exe 3380 identity_helper.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3596 wrote to memory of 3524 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 3524 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 512 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 3284 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 3284 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe PID 3596 wrote to memory of 4536 3596 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qptr.ru/EDcn1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa84c246f8,0x7ffa84c24708,0x7ffa84c247182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16140539158279265711,1080664577525785544,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD547b2c6613360b818825d076d14c051f7
SHA17df7304568313a06540f490bf3305cb89bc03e5c
SHA25647a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA51208d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e0811105475d528ab174dfdb69f935f3
SHA1dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA5128374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
384B
MD51ad8a20c1d2aefec6d685aa44d1b74fb
SHA108d2c5f964e11e0d5c74ad3225d3f3464ac11beb
SHA2563e175feda791151c898d74d91e497ed356bc7fb8a083d62d54100dd5c9847999
SHA512e196f3ff017a6f23fb52f2cdde30a22ee329d8826d8baf59d03438a416643eee5e8f559111d87ebf95311596804d075703ecda0ac1b80f6edd69a4b8f40fedcb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
994B
MD535a95e04ed7c7141b065291249454e80
SHA1e049b90880c1d8c0509445e277241d4509565f5a
SHA2562ac598183e3e2d5344d2305620f0993e4f83369107bc75c56f790d16eb9e1802
SHA51276677e884dd7f6c2febc0527823a6b4053863272290afd5abf1c6d3d2fffb8498b7362d2aabb8e7f4fcdb4b440625c79af9f68054f2f5c3932350737ffaa43de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55a1b697f647557957b80dd6df8c73278
SHA1e997ddda8cc93445dac797403b420aab765c8143
SHA2564ad9ab7bee7f11dd40cb69a2e1099b09ca086c2e0e329f7501af6c2942e68b80
SHA5127b1b4c2c986f22a19b828956805df667bcba8a15e70fb54f338469f1d0a105d306be23b0cbc80c3bb066b11084e5893e7cf92889bca11301dd2d672bfa9df955
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53a06dbea1f1d16d73b9aa62ba7ff038d
SHA119685c6a19bdb5975bc34059af5a01b76e76a9e1
SHA256406cc93a0e7629c9dc66928275d86156b71cac12c1b22e0d3783ea69212db9d1
SHA51226d71e2f309b19abb8e6b807a2eb2aba11c73cf33ed129218dbe38c1a8b8e71c6e00f8f99a5582b5823f6c8bf363a2405f7cfe4b7dd1b3627e4236f34863adb2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5c7b6ced79db83a18650487cc2adeaeae
SHA1e981b827d6c8b120fe4037aa1f7a0d6ea98e5541
SHA2560b508167b2fb9107e362066c0b5cbb2c01ba4caf4e4a747cf7547e0c474eca41
SHA512c8d5eb00a118183fea85c1a980d33ee51034c0304f7f91125bd9d88c099bffe75b39038f0fd8f70afc8df61bf58071923e360e74f0a7c9c5a2fa5446cb145789
-
\??\pipe\LOCAL\crashpad_3596_TPZLDUCCAOBDNNBDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e