Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 11:29

General

  • Target

    https://polsirurmanglossers.com/?wdkxnosz=0faf06a41b10c1bb718e023b72c31984b58fc5ab62d83e9f821cf732844586f3f4c4cf2cee2b2e7b334ef3a0223c662cbc76dab8088bd829f7ddfe7b963c7117

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://polsirurmanglossers.com/?wdkxnosz=0faf06a41b10c1bb718e023b72c31984b58fc5ab62d83e9f821cf732844586f3f4c4cf2cee2b2e7b334ef3a0223c662cbc76dab8088bd829f7ddfe7b963c7117
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffa6d5646f8,0x7ffa6d564708,0x7ffa6d564718
      2⤵
        PID:3192
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
        2⤵
          PID:2196
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:884
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
          2⤵
            PID:776
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
            2⤵
              PID:4632
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
              2⤵
                PID:2564
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
                2⤵
                  PID:1656
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                  2⤵
                    PID:4928
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
                    2⤵
                      PID:2500
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3720
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
                      2⤵
                        PID:1512
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
                        2⤵
                          PID:2988
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                          2⤵
                            PID:224
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
                            2⤵
                              PID:4120
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
                              2⤵
                                PID:4148
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                                2⤵
                                  PID:3912
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4848 /prefetch:8
                                  2⤵
                                    PID:4772
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
                                    2⤵
                                      PID:1580
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,9096454676549952904,3819441681924530487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5864
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:2340
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:3472

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        8b2290ca03b4ca5fe52d82550c7e7d69

                                        SHA1

                                        20583a7851a906444204ce8ba4fa51153e6cd494

                                        SHA256

                                        f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

                                        SHA512

                                        704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        919c29d42fb6034fee2f5de14d573c63

                                        SHA1

                                        24a2e1042347b3853344157239bde3ed699047a8

                                        SHA256

                                        17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

                                        SHA512

                                        bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        192B

                                        MD5

                                        111784ad3e0b5ec577330acd06168f7a

                                        SHA1

                                        90e4df32afbec41678dfa00e58d6fc43f9f9f8b5

                                        SHA256

                                        87d9832628747543bfd1d90e13d8d796aa1f15f617017f8e70776283f958e606

                                        SHA512

                                        fb59437983cdb4938a113a05e82af3bab3de1664850aed9e40cf0d7a354c3c6d70137ca1f384c0574fc7db09cae444c4159ccce15243a2adb0391720b432558d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        288B

                                        MD5

                                        d5549898d8432d83aba2a069939f84fc

                                        SHA1

                                        5ac950d50f1d919287e7a231274d2987910bdc83

                                        SHA256

                                        2e81ddb946717ccf84d9fd8aff20a9bb9ba6a39265bdb3dd7b968ee018e1501a

                                        SHA512

                                        eeb37da25e5f459c1e97e00e6a42bf43aff526ce9dfce6e5e889eb56d75beeccb69a2897dd37496bc3ddc9d7cae4e06b39258761ea0d76dea72b02a7f41eebd1

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        826B

                                        MD5

                                        25342b391aa6f01025c4b32d0f66fd1d

                                        SHA1

                                        5e779a73aaabec4236985243c1eaa72f82d88468

                                        SHA256

                                        3241ef6e8e902685ab624c22738e17733a9acb6298fca916226580306fdf8b77

                                        SHA512

                                        cbe334ff9b9230c102ab5d5f371e467b007901a4c6e1fb120b3cf9c39daa21eac1dd5575d5d11a3024b5a9e7ab9e3e5f78d5bb12292fb4327e8ca43fd1a160d7

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        461c4e151621e7e44a5d6181c7b97d00

                                        SHA1

                                        3cce086d4b2aa5548711c91b91ba7287a0734e33

                                        SHA256

                                        87b78ade321e2053655957aea4942d203f8ea1530205ad5979eee0927c29a624

                                        SHA512

                                        1151f6f8d401ebffbfc66b798fe8165dc77165de48645816c20c4b22ca6b3d212b36e4af23fcc424cb27114df48afaf7ea959e0a6c632d1e6b9cb7137be2c767

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        3204f142f4b65d6b36d986a4529334cb

                                        SHA1

                                        9e8a62f1442c08d5559163e8e9eec715d878d16c

                                        SHA256

                                        9c1cbcf67474cc9c5317880393711da32bdda458a50f57cab9f9c205b4ce2992

                                        SHA512

                                        bebcbfb2126ef44c36301a2ba47afbe9278f2de1b47ee433a46303a25300120936d311992cc45b70be59f55363d8ffdc7521eecc2e7b5c2ed5929c88ca7e340f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        871B

                                        MD5

                                        99c82514372f83674a1b4a4f86ed5c42

                                        SHA1

                                        6ebb4a010420a7842b099218b49da5686cbb3ebb

                                        SHA256

                                        bbdedce58edc9fbf9d782defc75f541c1eca79287c025ad9fb4644441532468f

                                        SHA512

                                        6858f4dc9e5903fb9076e82c465e661ecd77a0828c61a8188ebde30920700c326418ad58d5d1f8fc70d4e2a21b3b380932daf1664786fc89c22c6abfefbab0ca

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59115b.TMP

                                        Filesize

                                        701B

                                        MD5

                                        8892687f1033acce6f1be27a499bc4b2

                                        SHA1

                                        1471d5c99235b4a7da447799359a953a7b6ed6ba

                                        SHA256

                                        2fee445380b5ac118bfff276b87d53626d88ba9e7dd7591a9c50e88b34014a46

                                        SHA512

                                        84bacd1c639f3c53bceeb59d2ebd28e35d133d7cc80fa75ac731bd22d15cc9dfd613e50c1c35d58750453e915fc183ef9ec2c52d32509562eaef98131f7b5f44

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c22db38d-b62e-4aa9-87da-c7710de97b86.tmp

                                        Filesize

                                        7KB

                                        MD5

                                        143117f7f362f00e5ee65a0fdd92ff02

                                        SHA1

                                        ae4a7dcb3485cecd487c4d39cf74a3e4e1c01c8f

                                        SHA256

                                        ab1c1d5477350b46fa36e99e0d3081ff7665508a5cc876502a78aa36bee0f249

                                        SHA512

                                        e308ee1776b6ecb6ebb56ea6ae9a153f3330bf1ad695fb4982bf8b997bb0171f04dd9c8199287a47fbfef91b3568599b5af883fd605f0e02ae2256a59d05eef2

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        11KB

                                        MD5

                                        a968910d358b8f54d63f91612b1d74de

                                        SHA1

                                        0b87e6b573880a0dbe311ea816ffac27c4f332be

                                        SHA256

                                        7b01385492974e118bdf1890776da09a7337642e3639be3a0b7e0eb95f2b67eb

                                        SHA512

                                        6cf6c749d50f46d8439e6a5ca8847c0696f0eb1cb72d2acc51f2120643673ef85a0aa7bf0c4000d00152824e6295a1ba9faa3da93740022897c9084a80452df2