hxxp://trellocorporatlon[.]com

Analysis

max time kernel
79s
max time network
84s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25/04/2024, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://trellocorporatlon.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2548	msedge.exe
2548	msedge.exe
2788	identity_helper.exe
2788	identity_helper.exe
2296	msedge.exe
2296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3640	2548	msedge.exe	79
PID 2548 wrote to memory of 3640	2548	msedge.exe	79
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 4052	2548	msedge.exe	81
PID 2548 wrote to memory of 2416	2548	msedge.exe	82
PID 2548 wrote to memory of 2416	2548	msedge.exe	82
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83
PID 2548 wrote to memory of 4412	2548	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://trellocorporatlon.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe02523cb8,0x7ffe02523cc8,0x7ffe02523cd8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,15268306954894706075,13993293214133521876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
57e5c5a9236321d336e2c8ce1eeff844

SHA1
8fd4288af72ba3f7a0ecc5583a9265723fefc096

SHA256
ae6496cf397848bf3139858deaf567e3df991bab5a7704a0fa7aae95474872d7

SHA512
bc3f24afe6ce0494022d8201a01a60239ac5cfee54e0650a337036817056424b418cb636d58d07e5034dffe2226906202b56509e4cc07562c0b60f618c420080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
493e7e14aceba0ff1c0720920cccc4a2

SHA1
468f39cefbcf14a04388b72d4f02552649bf3101

SHA256
a0dd32ed60115f661a4ca537472e0d4e230ff844d56a3db766299cf4cd817842

SHA512
e16c748e4513ea10bf7124cef7b50dc5f3a1802205af9228e0c33fdbf3c24286739db08db4b813079ed7cc36be43d7457f4c26f00ae3126a2fafd77d2696107a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
259B

MD5
f66a080f600f8ebfab73a4de2072cdf4

SHA1
bd30b425a38a4f20b563cceaf574ae101eaebdae

SHA256
ee5c4673611637ba84d172e872962a687e1a92da2409612d02f45ddfb00ffd91

SHA512
f8e195e8c0f4e146e5c1fc1794d0ac5f6482c086edf1a6f30ba1bdbd29aea0dfaded4d6d628e982fc67b7ace73794c449fee6dea618e951b63881e2cbd0b97da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce1be596d737fd032576201e53552547

SHA1
55b080379c37c6669caf5313fae213098b508a06

SHA256
007050394e71444f44b078c0ad58a93bdc2093dc4a1e8b80b659dd9b3a0f75c6

SHA512
9b43e00840322960a4dad133cc90a43eb29f7647e3a9cde376967f3c41e3bfbe37612bc4ad9b73ffde7e4f97e5ddb81d2aa29c3be814ab70fb7f4e5758118c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
786b9edae6c2c74f790922acf42b87be

SHA1
88d047d71b9e53e416147b64a833fb9f2afdaba1

SHA256
5fbe9cf2187ce467ea5ed24cd5b24dbe8d26984b3528ec29bab777f406581a6f

SHA512
1eb43f45c34cceb2d09fce44ffdcebc71a1b98b630afd819ac075be3b38a1a7caa6b203ad39404fe5ec77aa99fe60b1ab20d902cbf02a5490fdcffd016b007aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e274e162a405f8c9d60aa9979553fd07

SHA1
6fe4ba44e25dea4bca104c1129110a6e83343600

SHA256
f19abcccf816e50bb701d25ab70f9ae573db2c2c6b1dabfce1d69e6fd6dc1a32

SHA512
bc6a143793a65ec34c4a5cd3e9c66722c6ff9d2b1c74e3ee8514ab0fee7b9384c43a2d47f4d00215f8c47a36caba8e05dab8374a72bb33d3e39a5d9e8f1e0829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
791f3c9ee5a00f73b1d89dfb9e1a9f12

SHA1
60a7e4591e722fb26822865e090616b5af498c82

SHA256
8048d4c7bfa610094e4af1e71f7f091139a817130fbbcbf57cbc80db56c09496

SHA512
353ff0d4496b3c5858b9460fee19d7d0201d8ec0a5da3a35d059fdb46595dab74d3d3a56372c0f6b6ef9e5f0ea4a564c25858c6a7b301ebefe8ec9f6d168ac94

Download Submit