hxxps://en[.]wikipedia[.]org/wiki/Kock

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
03/05/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://en.wikipedia.org/wiki/Kock

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
2976	msedge.exe
2976	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
4028	msedge.exe
4028	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3972	2976	msedge.exe	79
PID 2976 wrote to memory of 3972	2976	msedge.exe	79
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 2336	2976	msedge.exe	80
PID 2976 wrote to memory of 4924	2976	msedge.exe	81
PID 2976 wrote to memory of 4924	2976	msedge.exe	81
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82
PID 2976 wrote to memory of 3496	2976	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://en.wikipedia.org/wiki/Kock
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff60fe3cb8,0x7fff60fe3cc8,0x7fff60fe3cd8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,15620406744188232364,2044426632870680411,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a85ad170d758e61ae5648c9402be224

SHA1
e6dfce354b5e9719bc4b28a24bb8241fc433e16f

SHA256
af0da8b5ad8127ae0ef7773bc9c4b145ed3fe7fbef4c48278649e1e3aa5ce617

SHA512
641414d91c993f74b6b71654522359d606c7f94ac0fcca6478d1bc33c30f4a9fdb9ce6f8e281c79a2f9b9670fda8a4ccdd80e7d64347c1f66d8c9ef024bcb09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
22cececc69be16a1c696b62b4e66f90e

SHA1
b20b7f87f8bc64c1008b06a6528fc9c9da449c2f

SHA256
d940b85bc83f69e8370a801951eb6b8bb97efbb3aa427664105db76e44707258

SHA512
2b2e548f2c8f84d321ef2afdf31128065c3593b884ca8111b05800960b5378b99c7efa6165d02fba4c11e6e4b49b14e419d89f76d55ef574f4ac2b7d6ecb3d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
12c263b5dee6e053d2190725616137cf

SHA1
953ae035b3c177dc6130abe691ac5fa44f197d72

SHA256
6645d970b8d5afcd051b8f24728956da5a52322239a37faf167ba4dab0930416

SHA512
f3de9eed1ef56d3e70461d0cbdb1101f1651c34077582c27811807510f9d300ac2de69b41368d022cf3e11351a264c6b358c3f39ab28445af945d380ac576bae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
262B

MD5
8c29239329eb2e4539f498fb824b9cb9

SHA1
866aec5a983a676f4564c73811b47773050f283e

SHA256
9d79f6b74f629ece497c52c1bdd2873b08a86b8f44aaa0c622a00efb1cd5b15b

SHA512
cece95d8551b765994d5c46ca30069842ad2ee86aba381c7e85dbbe913eafa7b7eaf5106963ab82f0ba92abfbbc8b7fb01f5b4eb55b15fd0f27e70f667655113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1bd093188debd85e40afc25f0d361023

SHA1
ecf828c3d35d263625b7483b5dd3ecf3617bc0aa

SHA256
7f7717f6622e3eacc05072fc500e1786ec8fa5c1cf0148f1e90a818c6fcd55c6

SHA512
dd10ef394748c43b4c9facca2474b2e27e822e9cbeca8fc7966c18a53b7cfe47560241802695de15716d117838e4f1ef5fbf89af27fd020daa3227e25a14d727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35cb3b2238bb1393f4de4ca4c878849e

SHA1
c4d6fd7f4c2b935f5d03c17372cbf7b556a615d0

SHA256
e0c6498689134113934e537bef50312898f130cea0bccf8e38447211f0b817cc

SHA512
9d63b9b3a93262a3c4b2433c5e0bbf17ca98930c75dba48f0acd8cc66a38b0afb6e09b4ef35c481c17fa28e4b5c57a6065dc37eab104b5fc900d49c6781f64be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
547b91b913aaceef69dbd479ed7f2091

SHA1
c152671a702264f5165ba9aa4ec48d21f5270d2f

SHA256
cca43f15fa5d2c8a19c97a715e89c48a8891845b47ada59246e1813fe37281d8

SHA512
1ba1a050aad6739bc30328be1a172613a7321725a3861154d4f0d4d4a859ca38dbd771005dd2e715d921da9dd0b4c85b9e4019bad2b1ca6f30b84292bfdcef3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f82ef6cf8d09458143202e5ea1deddb

SHA1
029fb3bba5673824a67c8eb542178c847a12b766

SHA256
b34e74df439ee31bdc1c7cccba9045ea81cddbac9f2312e19dee15ec11301aa5

SHA512
e6105084d520abeb30fdbb1530903de5f461ff47cd4fb5101d2b8886c95013d60cfde0da48eeeb0a2f3e8f1d53342e28e61ce56e763a6c91077be96aa4995712

Download Submit