hxxps://qptr[.]ru/On0o

Analysis

max time kernel
1167s
max time network
1172s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
13-04-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://qptr.ru/On0o

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
1144	msedge.exe
1144	msedge.exe
3984	msedge.exe
3984	msedge.exe
4680	identity_helper.exe
4680	identity_helper.exe
3956	msedge.exe
3956	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3984 msedge.exe
3984 msedge.exe
3984 msedge.exe
3984 msedge.exe
3984 msedge.exe
3984 msedge.exe
3984 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3984 wrote to memory of 4892	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4892	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1380	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1144	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 1144	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 3012	3984	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qptr.ru/On0o
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff961663cb8,0x7ff961663cc8,0x7ff961663cd8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,17323097545147530862,14256562438964868383,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2740c93dd78962ad9f13777917f70bb3

SHA1
a3439adc4e310594bfb88f677ba662a2165cf8f6

SHA256
4d834bfed93709866be1efbbb76ab57a6a942d1e2106095acb3643e3a49e879b

SHA512
d0ca3a9db1a95bab1f9dc6925cd40ec545bf8cde07fbbef2a51bd18e96c7eb167799a195f62db6f38043155c9acbe2ec5b1607e0e7f76c4e069501edcc35748a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc5d52992e41687fa70efc27531f778d

SHA1
6437d388bc4423de222bc1d10c39e86360497083

SHA256
eb037bb42f7cc1e8a3c419f575089582952678145740efa9d1581e58716d7870

SHA512
b7cd86df836ae883142bee2d91a300d421b8f7887e0b768dca7025a67901a6fd92f557ef1b8313470abd4630a0f5ac261adcfe9561766f75e6f8d5cc8b8ee5e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
71e136f50d37b34a57bb1eca58061b6a

SHA1
233c6fa7db3f2b97c16ba84081a3534edd3374f3

SHA256
ef5865e4a7b0f1cce5b3a5c9696677800ee61981711a2fa0f4e9482a5626280c

SHA512
c833ef97c6449ac2ee64d7ffd46805f16a4704147ff379ab8a9d27a88de5cbe2a9706e3bfd40dbed283c957abc552033c4ea7f0d1335b104b0aad262f7393eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
911B

MD5
4de5646cd10b4d7603ba450cb48e26c0

SHA1
657d12ca54dd4574bfdea4ef48107f1d63cbdaea

SHA256
922398621eb0e7ad7067268addf8a0223b7125ef03bcecdbbc24c935fd640549

SHA512
dd3e51180cf367c5d36ce593e10648e6c9dc8df4b58c7c39a9ade0f3c001277406e39d864a888542d163e4c55e45c03c097a3e8737243b36802f6ba2f4dd2205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4358a6a62f6cd2a17fb1c942a8fef74f

SHA1
f7cf358a390170212a58f2747ac61c2d001fca9b

SHA256
2fd6e340be63c6b5d36139979998127b7c0f701b6c05a8c402a9dc680c34127f

SHA512
5d1f126b8975ee723fcba21b8571d9c46f94668f3388713d13d9d3ce04ffb5dcc12372b90cf67aeb58a918b8637474cf45672d16a3e84b4eb4d0489c254d00e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5958019f137b09c97838c07049078b5b

SHA1
3d0c7ca3601f8601e9a6c504d0e0589f2a696b22

SHA256
c08eb07bc87e1e6fa9f7e9699b56dbe568ab5949edc4382cbe39dbdbd13a4f0f

SHA512
89fc08bf139c9623e911caf1c18216eeeb2dcf4c7bb4c3827ad7ceeb16d35ceb0cffaa9d16bc453d0f700aeab4732e14ba49af94b216d6eacb10cf0992dcc980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e6da5fbe230f3a3cb2dee3086eb4913

SHA1
7465dc69ac070fc490f8ab45f591f2d8b29ca0f5

SHA256
842c457f91ddccaedfc9bacfa2bc8df1a834d38d232ea84c0d49c7366fa7466e

SHA512
c530ad818251396d88d5e6f57e6f565af53ca55e2501b67f6cb3c4882382267f99f1d246fcfcfc9e9621907018908d1d8ba37e1a80f56b54cdddd2e43f566f0e

Download Submit
\??\pipe\LOCAL\crashpad_3984_IXVMTFUIPPHTECKA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit