hxxps://mail-office-365-com[.]weebly[.]com

Analysis

max time kernel
145s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
06/05/2024, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mail-office-365-com.weebly.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2000	msedge.exe
2000	msedge.exe
2700	msedge.exe
2700	msedge.exe
3920	identity_helper.exe
3920	identity_helper.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2016	2000	msedge.exe	79
PID 2000 wrote to memory of 2016	2000	msedge.exe	79
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 3108	2000	msedge.exe	80
PID 2000 wrote to memory of 2504	2000	msedge.exe	81
PID 2000 wrote to memory of 2504	2000	msedge.exe	81
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82
PID 2000 wrote to memory of 1232	2000	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mail-office-365-com.weebly.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff1f9e3cb8,0x7fff1f9e3cc8,0x7fff1f9e3cd8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,2643487278528355209,4671637030435674029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9faad3e004614b187287bed750e56acc

SHA1
eeea3627a208df5a8cf627b0d39561167d272ac5

SHA256
64a60300c46447926ce44b48ce179d01eff3dba906b83b17e48db0c738ca38a9

SHA512
a7470fe359229c2932aa39417e1cd0dc47f351963cbb39f4026f3a2954e05e3238f3605e13c870c9fe24ae56a0d07e1a6943df0e891bdcd46fd9ae4b7a48ab90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7915c5c12c884cc2fa03af40f3d2e49d

SHA1
d48085f85761cde9c287b0b70a918c7ce8008629

SHA256
e79d4b86d8cabd981d719da7f55e0540831df7fa0f8df5b19c0671137406c3da

SHA512
4c71eb6836546d4cfdb39cd84b6c44687b2c2dee31e2e658d12f809225cbd495f20ce69030bff1d80468605a3523d23b6dea166975cedae25b02a75479c3f217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
52fb801a566e161b09e8efa04945e529

SHA1
7c3cf09b5289c2e8583dacb05956cd34d6df0a4c

SHA256
0024523009689d4f033e1fefa5defad843f1d78d43c9da1341b359ecc877767c

SHA512
e95d4474d6265c809ec74ecfaf34c4c00d644a0cf3df7576f3f2d1123cc48847905a87a0690a8adb9d17a5d2b2bc8b109adaa0b6f4745868c03c9435e5007396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a348c2b3e25db65903dc3986618e25b0

SHA1
9f21aa63a28accd70b2dff914ebb9dfc94068ff2

SHA256
23135d306e061c14e85cf69195f188b4fb5f2bddc49890a80b8189f2a3fe43eb

SHA512
4faabeeacaefab0a3b52bea99d9d1dde78270b94c53fda950f700ed0e58216d7d743eec319bb4a5cfc55f799318c4d00466c2b3e7bb17d15cc70a67d2598439c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef7d850f1071381cdc90183cbef0223e

SHA1
06f484c1d9ec8ae0659d2698e1ccf22376b97a4e

SHA256
29f26ee32d1b0a5f653459fcd3ad80110e0dda355be37bc62981f7f56308d005

SHA512
aa544c837349b20c4ef237d5d8e1275a8423bf1ffb6df693d1b10f5d9b46624246aeab7b0877d77e50e2a110b96d2de38fb3d89d0e2378c25dcd518b7d48fed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4f483f3dcba71cb1b776eda34b19ca1

SHA1
93cfd13b71159c29da97325fa991aa34598cec51

SHA256
1d61fdc04e553fe31737f5528c128f88a0cf42374c2e600c18c7d47ec28288fc

SHA512
9f024e2947dd228aaff3f308ce583d0ef85671fc611dc2d595735a46f45276d3cafd1ce0aba5c4186595cfb6f9306f4b582606022bdd3e34b5960538ea013e34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f048a92ab66eac9a91ea34594de196b

SHA1
d630160133b3dcf2c076673e1a73f1a40cef4065

SHA256
ca1105071f4d63c3c1a91a0448bf848cc1230e99cbac6f14f90a572307f1bea9

SHA512
968f7a27733963499b02c308bdf2aa057cfa4763525b12e1c25c0e530516694f1fe1db04144e2be47a0bbb3754194e0fc528cb6ad62552f87300b43e24bde766

Download Submit