hxxps://pub-3b3bd6b1f63a40cea6ed5d7487a2730c[.]r2[.]dev/keepsame[.]htm

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pub-3b3bd6b1f63a40cea6ed5d7487a2730c.r2.dev/keepsame.htm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4316	msedge.exe
4316	msedge.exe
8	msedge.exe
8	msedge.exe
5068	identity_helper.exe
5068	identity_helper.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

8 msedge.exe
8 msedge.exe
8 msedge.exe
8 msedge.exe
8 msedge.exe
8 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 8 wrote to memory of 4512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4664	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4316	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4316	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2468	8	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pub-3b3bd6b1f63a40cea6ed5d7487a2730c.r2.dev/keepsame.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3e0a46f8,0x7ffe3e0a4708,0x7ffe3e0a4718
2⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
2⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
2⤵
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
2⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
2⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
2⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
2⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
2⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,15114019995518963677,10175457748488509030,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\23e8d3d7-dae6-4a50-86eb-e46e7fa008b3.tmp
Filesize
11KB

MD5
a37c7d506585830d39a689763a9d3aab

SHA1
2677b892c436ea606714262502e8ed83c9ffb7b9

SHA256
44937cc219b4c66a8316dbccf1226b61c92a86cbe83021bf644d2d34aab14cc4

SHA512
5632d659ba891e774fe01e873a34f6d46fde10c67acd21bdeb1e116a4242bb29626428d5ab3a0a65e82986d8bf7bd9abc5eb9b1a291ea4e439ca5034ceebeda6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
123d8faaf1f9f3735f946636bd4025ce

SHA1
d71aa055a58cf105f03207f2cdf166684ce94a9b

SHA256
ee6f52c57375e3b29ec5bae6085e70a14764407c3a891153e08e65df41d17c81

SHA512
deafd3dcae7ae7b86afdf1fc020041bc2a9fbb95c1443d98592736dc3496efdb1515b5d7dc5e0383b68117b8b7cfecf9e6e7b2354181a83aa4ecdba0cf4e70e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
820B

MD5
5c562bfa9e775730a8ddb7675b2ac3ad

SHA1
6ff1c0321b8da321c50ab1bdb0b73fbe4adc6365

SHA256
66993df551237f78fb6da02c79d7c0c07f76054dc62e30c4bd17044b7e49c4ee

SHA512
cb02f9e3ec03702030186cc4cac932bf89827b5f84f89976220b91a3d5f08a624c99f37eb6868d91ff88aa0956d428153981eb1ed40d6a4f5da4939b2eee5cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6e65e40304f065385511b85a36ea4365

SHA1
5e31201beefd6b7723e9df913b873954a1ef72a4

SHA256
bc4e283208475af16602bba11d8ad2ccdea755842d6695cefb0906564076613d

SHA512
c7742547fe3efc6433bd6b05464461337902da1c10cff1832a7d4b6cb5b40c5cc1c802449a8f63709543c757e694b3631b0b37547408eed32f3763ca354a1597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
89ac06d811ef2c7d57fe0cb0f20fd82b

SHA1
ad8a9f96e67555e1d18a8924740cd3959ce606c9

SHA256
f827959eaabf764a95bebd449500ef9680d55dd4d702a9bcd95ab553edfa9500

SHA512
09a473ac76c3df409af3958b38a2699bcc4559f37311f728cb38eb21f94aafacba306795a9d80a5848ecdd62e5e8a1cb09b972912ed02f0175b2e7bc674404be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\LOCAL\crashpad_8_YTPRMTPVVSEEJAXV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit