hxxps://white-elephant-728972[.]builder-preview[.]com/

Analysis

max time kernel
112s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://white-elephant-728972.builder-preview.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
1604	msedge.exe
1604	msedge.exe
4688	identity_helper.exe
4688	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2432	1604	msedge.exe	85
PID 1604 wrote to memory of 2432	1604	msedge.exe	85
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 4936	1604	msedge.exe	86
PID 1604 wrote to memory of 232	1604	msedge.exe	87
PID 1604 wrote to memory of 232	1604	msedge.exe	87
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88
PID 1604 wrote to memory of 5072	1604	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://white-elephant-728972.builder-preview.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d0ec46f8,0x7ff8d0ec4708,0x7ff8d0ec4718
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1416280148245454490,17506734316228389495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ca884ceee078090220d09fb7c46b9b28

SHA1
4d4231c13ecd1edb5d3b04328dd2f120885268cc

SHA256
aadfdf479859c08c3a1df3faef9ff4e11b786c499aee500205f630969d8831da

SHA512
e4fd746a97db238af02e37c3f3c98519b8bf47ae8a830c5b23210bac6c9a3e93663301fae0750bb6bd530d42ea82f3f8429eb2f1474d24f661ba7bd99b61789b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
856B

MD5
2257b44eecbb35f494d87a00b1103b86

SHA1
20c9d50995cfa61bbe1f8938aecd22e199a35909

SHA256
a217f2828ebe0d352982fcc0baa60f8c9571f2b9e6bc5103d6004e5b2062c151

SHA512
23734cabe4bdd716a935da24932208d55fd86469fc9ff23e37287453b14455adb7738e509dbefdc4ae8ee5fe71573ee23601f3dbc78b7cfa18caec38173f9f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9c4a5d595b6916adf815e7a71cfe822

SHA1
a0baf412e87aebd8e1d7ef7aab93eaced997785d

SHA256
10510923b5e3a90498f2223b1448a329beeb52db48cea0471890e16662330eaa

SHA512
70362c832414932e674f0b666d93e512db41858fe3591b295ea31704eae7a6ab391da15654ea01e4c96c62d2fa04b399f6025de427562c94dca9b982ec934ae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10d8031ae7439b3da63b54ed7b739545

SHA1
326e533abf59754414c6b1b007e73485c2819639

SHA256
6d2f2eb1fb8874bd03b52b3c952fd03e4d8c53317a119ab223314641d4dbb97c

SHA512
b454b75dcb411d58f88a160bb71512eeb6ec9b964c68357ff4a1d0c5c6d740c36547acfca2ee1449cbde05777ef4260f38c10e244e4841c17b31d2a2684fbc11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9d5c1775c1ed651b0f4875ff75015a0c

SHA1
590a6ce019263873e7ea3addc885d6905a69f9d6

SHA256
41148baaa917c5ca9a6fa26e8b8f0614104ae6f33cdac17c9f8a418bbd602660

SHA512
e070d576628238f828df417c1b2249915d28cf529f643debd4f53bac100f61f2752fbde3eefd283c66275df48ed47a26ff0c70255452d0512e18df661c45e860

Download Submit