hxxp://flyordie[.]io

Analysis

max time kernel
145s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2024, 06:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://flyordie.io

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
3200	msedge.exe
3200	msedge.exe
2372	identity_helper.exe
2372	identity_helper.exe
4500	msedge.exe
4500	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1944	3200	msedge.exe	80
PID 3200 wrote to memory of 1944	3200	msedge.exe	80
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 1368	3200	msedge.exe	81
PID 3200 wrote to memory of 428	3200	msedge.exe	82
PID 3200 wrote to memory of 428	3200	msedge.exe	82
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83
PID 3200 wrote to memory of 4424	3200	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://flyordie.io
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9d9fd3cb8,0x7ff9d9fd3cc8,0x7ff9d9fd3cd8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,15515596875976799113,10968342509802631233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6e15af8f29dec1e606c7774ef749eaf2

SHA1
15fbec608e4aa6ddd0e7fd8ea64c2e8197345e97

SHA256
de9124e3fddde204df6a6df22b8b87a51823ba227d3e304a6a6aced9da00c74c

SHA512
1c9c9acd158273749e666271a5cdb2a6aebf6e2b43b835ebcc49d5b48490cbbf4deddef08c232417cee33d4809dec9ddac2478765c1f3d7ed8ea7441f5fd1d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e5a2dac1f49835cf442fde4b7f74b88

SHA1
7b2cf4e2820f304adf533d43e6d75b3008941f72

SHA256
30bd1e1bafb4502c91c1fb568372c0fb046d32a4b732e6b88ce59ea23663e4ce

SHA512
933ac835894ce6cb8aac0261153823c96b6abec955173653dd56e534d644efd03aec71acb4f8cb0b9af871962296ec06cd03e570a0ac53098b8cd55657543786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
b77fd3f0bade5b3eb8d031f036af1187

SHA1
0524d4b929fd6b55397b08d32208419efd4ee0ed

SHA256
10cd0b64be879b69489143fd8f23910276478ab93747603911d82fc36608380a

SHA512
599f7ccf9ba196d90814e5950797a8cf7f64b3b4903b715a7ea6f41ab175d941b92dc12c57982e50b285404ef04d405627b19f82bd1a1ff77d4907bc6ccf57f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3ea5df313fcf7d86738f6c58ed520649

SHA1
086a1fcb448fd4b4371bfaf1c5e8860765995c94

SHA256
5a15d52b0121872b6b78dee146caad737a7fd3281a440ee14c8f61a77d591393

SHA512
f3abbc2d65e8ab7e1063a1c6200b0843bda8f970fa228c7a08706bf6936255867779c9f08c50f7d0efce2c6ac2fc6ab4bac116d37c4f8cef514ecbef7fb3913f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2e42bc6ef11e21b832f86b2c331cb8ee

SHA1
c7a4f472fa6c4a0e1d003ee21769f68694e9c337

SHA256
f0da61dfb777a0ff418ef2da00558b151e6315e1e8b88341bdc7d47c473e7600

SHA512
f8f00ba2b39443146dd41910b6460ae2c0f28073b3990fbaaa064695755a3e1b809a0fb5968cfe42688fc4d31db8add63adebf45fe0fe7ce580b33f807507724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
37262c1d5270669f8e1f4b81ce45af78

SHA1
5c44e917e3f78d459649f14e519ff9572a188973

SHA256
4804dfe9c8f11b85265e890a0b7bb9399164c43d7599b0cdb078a1c14239ce95

SHA512
f075e43a1296df0e3ea43208563be1601e0b4e59b3df614deff41db32a5e01b6762ef12b8183ca0c8c4d04e0840d659ae578caf306bd2d39d70c7b6cb9cfeac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
06081a0d7fce59778fa4d9f310955afd

SHA1
b2c8c82ae72163e27bbe64661388e5d8f87fa1ab

SHA256
4d2f674ac08fc890f7eb71bd9d41e25afac619a224c9df4bcbd8aacb76f76627

SHA512
23cdf8643b264fd14500b96709181002f719f6b7e997007865020ec34f6e7f498274f67eba240fde7114a8a52ab81a8631397efc3e594cb0cd8559c7256b934d

Download Submit