hxxps://www[.]adminsub[.]net/mac-address-finder/0001cb

Analysis

max time kernel
317s
max time network
329s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.adminsub.net/mac-address-finder/0001cb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
2652	identity_helper.exe
2652	identity_helper.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1580	4640	msedge.exe	85
PID 4640 wrote to memory of 1580	4640	msedge.exe	85
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 3040	4640	msedge.exe	86
PID 4640 wrote to memory of 2796	4640	msedge.exe	87
PID 4640 wrote to memory of 2796	4640	msedge.exe	87
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88
PID 4640 wrote to memory of 4884	4640	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.adminsub.net/mac-address-finder/0001cb
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb12b46f8,0x7fffb12b4708,0x7fffb12b4718
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2803837933707154052,11979179641356817792,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\184dad5a-cb1f-4622-b9e1-ae255ca1606b.tmp

Filesize
1KB

MD5
54d152cc710e71685f806ebc157df79a

SHA1
9297c8f581a9ebd8a5260b73b8ec244e789c95c3

SHA256
e571af70ef0a9d2a5d21607317a8d383c5f1624b1a715d1bbdd10a8ef3d6ae06

SHA512
7d3a8dec8da6bfe61550a6a91cdb6fb4ef1bdf9232280832d725876dc7326b43252b601653c45012dd5d94a0ad88555067bd8c4ed9ec6932b9116dad8e419f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
8d9804f74db237e6c55174cbdae0af18

SHA1
5c4d6012b74b291ac43d222e37ca16157bee53fd

SHA256
4ae421cc53f2d06f9bddf0a8a21878fd340f41287f42feac831bc5956ec21b44

SHA512
50b3003df8a90b5e015a2c85cc108bd88956bbd611a78e9880b56a316809c82d54cae0d491914abf94ef974564e6d2da771eccde562efc687ad4b70dc6dbbaf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
071fe7229ae3f80de5f784e0914f292c

SHA1
d3f472eaaa733dc3ebbfd7b241992c7c554cdf95

SHA256
38d235be3dada56c2533a08cc68d994c333eb86f6c80e0ea1de5abd8cb72c65d

SHA512
f40471e071df32cf72c550fba853c05dcb918fb426eb88fdcb222aff8744663fe11ae8ad49198aeb1befaa3285e3edfd21226f2f270aea7a4c59dab4ac82610f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f58affbcad98304f18f0fb7be84baa8

SHA1
869846917826fea50aec04eb3bb3a6cdabdca8ea

SHA256
0080127516ce845c2c310bb4ab503c6b20ca86766c7e62dfe015b86c1e4c7342

SHA512
44eea7c7fa85fcb6732b4bc842a64df46b61959997ac7c83b7ff713d1666fec1b891aa704daea0ff6d198d035d7a2d2ee057848a484c2c028d10d05484ec4d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c8ae0bd3d48868cd61433d012f069df

SHA1
da9b7c1ad0ce2fa5cfa9d8e0b686fee1f11dc126

SHA256
e2669fceeddeec4cd5e0c3d80cbc4eee5b3b0726c59ca0a10be3d25c4b8038e0

SHA512
88563197788e79d11653e75bcd84cd7016b5e4e8069a789a76d4649e9d40cc7818481ed02ec0460377247dde297cc2ae0b47c6d042400c23ec13cd36eb9319e3

Download Submit