hxxp://www[.]parentingtipblog[.]ink

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.parentingtipblog.ink

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
404	msedge.exe
404	msedge.exe
2064	identity_helper.exe
2064	identity_helper.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 5084	404	msedge.exe	85
PID 404 wrote to memory of 5084	404	msedge.exe	85
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 852	404	msedge.exe	86
PID 404 wrote to memory of 3320	404	msedge.exe	87
PID 404 wrote to memory of 3320	404	msedge.exe	87
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88
PID 404 wrote to memory of 1468	404	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.parentingtipblog.ink
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac73846f8,0x7ffac7384708,0x7ffac7384718
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7550827187667432195,16068791795810164839,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
505B

MD5
a81ca2d3b7bd88635261093aa9c756cf

SHA1
e98d811b73ca2f0cdfe895a5938d000ba87034a5

SHA256
33078e2ed5e9177fb2a0c33d510ac90c8397a6a882e3b28fa8255c0eeffe6b29

SHA512
4cc5265563d0ff2b045320a6138a355d88a1dcd76459b671f0ae46b1a224b62182d2bcf0a2a3e11eed1d49c1ce5ec876dd9a450dd1e367cebb82b21b587c2757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a03faeacd6000d17e96e4ecd453b01a

SHA1
114ef62c1f16c197f56b278941db3a005d5e2683

SHA256
69c45fa9df355c37b256b7d9229f43811c8aaa3c86202936b5a6c2f2eafff679

SHA512
84d3f79b2c5e9980f29d2da369798b7308abc1bf04164d916a369cbc94e7d968563c443a1d64277d9db4730d9a7e4ff58589faccc3e89a732ed47f74fba05c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5a7d066ed49da8798f5188e436e57d1

SHA1
1bfd936d96b1e89db474fde91ae01a8d22e68a14

SHA256
4ddf2df735004fed0afce9adedb599fd3dfe1657b2cccd60516da59787e493d3

SHA512
5d3ee47b58ba079839f9c9687d558a4ef816f5ccb51cc1caf20fce7c567d2faaf18859d6405188e2dd67ab00f7eefd224f484e86e40a3089148c5d5c3a9ca977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
88cf4f8386dd80b9f436551af215416a

SHA1
7e9c843217b7b68b78ddd14c6fb31fa8bb8496ad

SHA256
09ff98df4c5f603230f40e8ef26b47f9ec6840467b396e82726592f60f6cc28f

SHA512
9570957c0d068cc6603a737e771bf769bd05e71c724eef62af620b0f7fec7ce208bed4001bf9801496c449d5f3744a6a3db11a78edf3853cbc7e66be46c22230

Download Submit