hxxps://acrobat[.]adobe[.]com/id/urn[:]aaid[:]sc[:]VA6C2[:]edc59740-74d4-4298-87ad-cdb6852bb760

Analysis

max time kernel
300s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:edc59740-74d4-4298-87ad-cdb6852bb760

Score

10^/10

adobe phishing

Malware Config

Signatures

Detected adobe phishing page
phishing adobe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
744	msedge.exe
744	msedge.exe
5060	msedge.exe
5060	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

5060 msedge.exe
5060 msedge.exe
5060 msedge.exe
5060 msedge.exe
5060 msedge.exe
5060 msedge.exe
5060 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5060 wrote to memory of 3592	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3592	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 4136	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 744	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 744	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe
PID 5060 wrote to memory of 3224	5060	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:edc59740-74d4-4298-87ad-cdb6852bb760
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8ab46f8,0x7ff8f8ab4708,0x7ff8f8ab4718
2⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
2⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
2⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
2⤵
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
2⤵
PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
2⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
2⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
2⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,2238524133879864326,8703383643761402141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
888B

MD5
6ca679cbeb5c3f0943e257674523eb99

SHA1
42db5552a28033a2f1eb286bd4a660844e7d9941

SHA256
ab181e36640f9cc4457c80eaee805dca2d9c158b6ab661a7e5e088abf4db1859

SHA512
4fc288aafd8c7eb196fa5c08536aa64696558b5bcc6df9dde8fc8bf7688adeeb444318c48adf9a0b3f0eaecda82179c718c3d4c24cb7aeb8075e709d408240ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
888B

MD5
75c1c05a20773fb70487b19398212ebf

SHA1
573b60a6797ad7ce0c24b9308361abb81d8e9b1f

SHA256
8ae04e9510423a2aac90b50ee7c58430eb1f993ee62a94d53a41bd93bae249d4

SHA512
9e906ffd79618530e496dbe18bc31bd11fcd9f4f46a52a806cf4629a11e3d337f8b020bb19c374958fefb8c7bff2af854c5c8e2f27e34121f1503824077620d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e4dbd99c33145e31e5c710ad8a685127

SHA1
14ce2bfd8498fbc03665d41282597c33ef45da49

SHA256
51545751a7bd8e6acd18fb8b5cf2e750240c5037fdefbedb06f2486dab6e92b2

SHA512
b7f9f003020952e4b063406220ce5a6f296b4b0380a26054d63d174eeb671cb4a4fcf0f18ca47be0abb76307cec3e500bc1c2819ae735ba7a6634388413cca85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bb61363863e3869ef6e4a9ba8ff8e852

SHA1
b0f9f4561ade2fff9d0e32489d68d864618ba6b5

SHA256
636a55f43fc7f1bc053a11523d0df4836d9c38c9ccb6c5e64dd9d88e3df19e4d

SHA512
c4ccd85c60a06e3f53f6c79a555e6f8a2a877f3e3c095b929294e5525d6af4f7c018469630facf1ebdeec91979a61dde9c843549ccc3f7d2b898dbf409e7f834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7150cf3abbe8856df98ebcb450464fbe

SHA1
21903f78db68a39309683ab1688d33f23567f669

SHA256
5e7053676259d379ec5a06aa9c65883297e55f3b3c8e5fa688c3fbe4ebf80b57

SHA512
0f226f1640d71bb1795dee0f940b3ff0ea3ba81332e233b07adc61238d3752cd3e96e052c90ea6f4a3868278391f99f17b3c4a136b67a79957291785842aa1b8

Download Submit
\??\pipe\LOCAL\crashpad_5060_TYLHKOJSXQSTQYRW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit