hxxps://new[.]express[.]adobe[.]com/webpage/dSGr7bZVYmM8D

General

Target

https://new.express.adobe.com/webpage/dSGr7bZVYmM8D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

1612 msedge.exe
1612 msedge.exe
1360 msedge.exe
1360 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

1360 msedge.exe
1360 msedge.exe

pid	process
1612	msedge.exe
1612	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1360 wrote to memory of 2152	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2152	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 2404	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 1612	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 1612	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe
PID 1360 wrote to memory of 3420	1360	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://new.express.adobe.com/webpage/dSGr7bZVYmM8D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff74546f8,0x7ffff7454708,0x7ffff7454718
2⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2223996645569348207,2851678458065834006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
2⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,2223996645569348207,2851678458065834006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,2223996645569348207,2851678458065834006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
2⤵
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2223996645569348207,2851678458065834006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2223996645569348207,2851678458065834006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2223996645569348207,2851678458065834006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4744 /prefetch:2
2⤵
PID:2648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b1931878d6b8b22142fd7fd614add5c

SHA1
0e20ec0bec5a9fe3b6666c3009626f0420415bc7

SHA256
d78e49cf9c940d8a407fca2338e30b754e4579c64e88932c46c3871f62c15904

SHA512
1e7a63ff7340719736560277601ff43f30937dbd4a1fbacbcb0d72fa708216692a4bb4ba658edf227b767975b430fc94e7c4f0b5dab29bef9483bfcfb38e1cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
70ae4bf8f75c69610c1d00131c1ec28c

SHA1
eab92c184a3b655377f375b1b25ef85fb06c7130

SHA256
9f46453862eb083e85697631455185c0ead19ec86c1ae3d15274c06c9a38731b

SHA512
29299dbc0114f01525bff67ec421a28056905e8f5d21f00502554f446883b6086f8b9a2c27a591f364077da17c21438910b8dbf163a59f6f80272eb7d5f05c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
189B

MD5
51d5ffec722ba6fd909c793f4f111cc5

SHA1
f5965a1ed82595e7a3138f0fb12880cf8526eeae

SHA256
58dc479eac5a967c3a24ee0df65e2a5bd19db70076efabc5ea28a70f22181327

SHA512
ed79a659ada570cbaa7c97b0a4a28c23506d0f2ab64f918f16c30167c13d4b04a1f2c0aed00a18962f5fdc30c3138da76fba96892af3603d73c263b0441436af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
53f24b44acfec230a0a7c668e8fe09f9

SHA1
9075f42dab769929f48c6bc54fc8480ebbdc60c0

SHA256
6becf5bff8a68fd7b6096a330e067affe017ad3533946055f64feb2f565ebf1f

SHA512
e726c8f6cd4b04f595cc7268e1284a309ac44081903012bd6d4d4a58d6993c86fe69c5262652337e221166c2cd772ed5341d3e482ba3809168fe331841049fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
044e71e8a6e866ad528e126257bf8a69

SHA1
c52bdbe2963e183f0a8d4712c4d385db83db8c8f

SHA256
413a41049b20665eabedb530ba00cc91316daa2f16a5d1461bd998396de0b1b6

SHA512
9f04191de2c52b911ffb35c4d0c6d8c170828b51f456b188f01faaa8c55fe16ff92d1e6e7f312572c0f6391ffd5be887d1ccfb98d7f5370b308ac5e87a7b8a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
037015ead6bcc59bc6faf918f1309de4

SHA1
d83ac6769430e84536f50d1e68d1311973ea0c56

SHA256
02ded8c40452cb970bb814f32d0ab36b59039c5fc1d55b059887319e2dc01141

SHA512
0f17337920d30c666e08b603024b9b97581b4fdc902f2207be068bcff4b616080d1d7239875721f69db6c2781a4830570bfd176a75a3ab144ce752b7907b1aaa

Download Submit
\??\pipe\LOCAL\crashpad_1360_PTHYTDEMJZCXJECY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads