hxxp://country-depend[.]gl[.]at[.]ply[.]gg[:]38853/

Analysis

max time kernel
145s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19-04-2024 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://country-depend.gl.at.ply.gg:38853/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
4928	msedge.exe
4928	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4596	4928	msedge.exe	79
PID 4928 wrote to memory of 4596	4928	msedge.exe	79
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 3660	4928	msedge.exe	80
PID 4928 wrote to memory of 1224	4928	msedge.exe	81
PID 4928 wrote to memory of 1224	4928	msedge.exe	81
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82
PID 4928 wrote to memory of 828	4928	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://country-depend.gl.at.ply.gg:38853/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb86c3cb8,0x7ffdb86c3cc8,0x7ffdb86c3cd8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,12266550619856886689,11933294433066054714,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,12266550619856886689,11933294433066054714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,12266550619856886689,11933294433066054714,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12266550619856886689,11933294433066054714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,12266550619856886689,11933294433066054714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,12266550619856886689,11933294433066054714,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54caf18c2cda579e0dad6a9fc5179562

SHA1
357d25de14903392900d034e37f5918b522e17c9

SHA256
28d77529de92eb605d8afee0e133a7d08e13d4386e5e38d63e2da34623eaad6b

SHA512
88da5a33df9d82408afb8344ec7dbaf7686435fdb55eccfb85d5560f39861e84cef5d71949d5efe7a191778e6be755a8448f3fc3d7043007037f9f5227e10210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
696ffba7b83ecf008523e96918f200d9

SHA1
970d90e22c8b3674fc33cdd1913c51ef28514255

SHA256
dc6dacd725d7385b2e4db1f488d93f2840d2289efdaaf3737849304d1ab9ba34

SHA512
f8528683b70b58376f3eba3338fa6b462c9e9248c72524573005cff6397a0556bdcc2fdc2ebb020ba8218bc8174ba552002f223a245dfe3d3688826d24d63237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b644b9460b533a7855a754a6f7414580

SHA1
463b1a1e94dc6a12c02a730d96106990836e921a

SHA256
77e5e5d9207397be8dc51ed13d638f2270085b1db17266493f29e9647ffe45f8

SHA512
1640fbf1710a995d1594f14440af688b3366649135f3333c5acc2e3dd610aca23772ec19e2e0945681e8517f99d9119f6bf266bd47e50ee50772d6266fb75f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2b2d807614590d64db828ecd4c6e334

SHA1
2a4772791bbfd96dcd82497f22abd9eda8f1b998

SHA256
fd82bac1af92d793c0576b2eb6e6190296fec80662785b937ee83950121ab3dc

SHA512
ee1aeb4398b7d6697bfc5000c788a0cdb63f71ab70c98a306da9d478c8d8058d3edee3e8d0854adaebb69f590f292f9cc422054d2d5a1603b1a45d10b63e67d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
01e4185e8ca9485f4b4ff068bd5943ae

SHA1
bc8ba4665217690c07f35a3e979b5b99ff2204c4

SHA256
174dcf1627ad0c387eae9ca00045a66a321cfccefca7a5ee5be7a9e3b514caf0

SHA512
56bf1357b507677a4bc0997d21d9ec179ce4ac541711259a0b5538cca9d51231c5c71565b469281414cb36647bd2cb693a5c9ddfc0a00146471b91f0a331b0b2

Download Submit