Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2024 23:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://qptr.ru/1qie
Resource
win10v2004-20240226-en
General
-
Target
https://qptr.ru/1qie
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 732 msedge.exe 732 msedge.exe 3960 msedge.exe 3960 msedge.exe 4080 identity_helper.exe 4080 identity_helper.exe 3716 msedge.exe 3716 msedge.exe 3716 msedge.exe 3716 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3960 wrote to memory of 2764 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2764 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3864 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 732 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 732 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4880 3960 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qptr.ru/1qie1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3a8046f8,0x7fff3a804708,0x7fff3a8047182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4550212524663963760,16536926929584993219,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5fd7944a4ff1be37517983ffaf5700b11
SHA1c4287796d78e00969af85b7e16a2d04230961240
SHA256b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
SHA51228c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a774512b00820b61a51258335097b2c9
SHA138c28d1ea3907a1af6c0443255ab610dd9285095
SHA25601946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
SHA512ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
168B
MD5f49d95bc4e1d52fdc889383f777d9b26
SHA1353cfc41f75d1eebb40517214ca9175c7c648af6
SHA2569a10fc97e745bdef97f25c0ec1e64e1a53daee97e919dcf512243c88faf3237e
SHA5128f641fbd9aadacc4894f56eeb992fd8c3a1deaa008ad333a2d84d497a831b493e38ad70b56ddcfa371d0e65356e68eeb7a1ac7d49f7db6f93df47e8e6c5c3a5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
853B
MD59bc74b71cdacfcdb526147b0d6285bfd
SHA1e4b0ea2994d728165d0806f8ef9d709cf927f5ea
SHA256d49ae2d9edb0bab9f300a8af446d909b235016eed2db30a2deface814e323b64
SHA51272c3aa15668bd343394b74c9b84e1b4ef1d9a1ef63084050946790558ea8d70aabc4a9ca43165b7ae4c80d0ed0d9332c5af43c72d60b8a31034951b6cdf1918e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD590e3ef0f3e0eb5b7b1a45d9f92eab80f
SHA13d7927181f9d1560bf82af6db8f4584d5e029fcb
SHA25672d7027fb3698ace3e06e738f235eb587ebb5d99551d1c4fbf346b7633ee2618
SHA5122714d77c9663e92e223f079be9fc3e13954c38e2df37be6d86de011029825ceae1759298d7459b28e45530842e94ae0d086ddaa5902aac0702ad16feea7f459a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57321aaf34b71ffd09b7fa3c60cd54477
SHA1ffdd0d22bb0326301fc56d9006ea51f66952ee1d
SHA256265c85d4022b1fc780038fdb050806e848fc11b52d725cabdf3b5452280348a7
SHA512546c64e0215e9352dbfcae044c5343a600a0f31e706b75867adb9acbf46239242f02e385a2573ec46fd3728bf0db2786bbcb223f5846110be613903df7670048
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5647388ee1abaaefc79ce71d943cf32b8
SHA132858924b468d48227ddae5ef8cf120bf66aee74
SHA2565fac6ebe79be5ca6f16079c17ca7915e9a7a8011e08bdeee6b9a2b7dcd163d72
SHA512d9f6beb549e4ebb594616aea502ba8d97403259b70021e40637ddff278fe34dd6c460b83004bae95510b4f84723a6eb8bfeb740b249c16a21dd96035851188ce
-
\??\pipe\LOCAL\crashpad_3960_JKKXOTCJKQJYEQOKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e