hxxps://sli[.]nypost[.]com/imp?s=124701116&li=54106&e=vettebk01@gmail[.]com&p=35257893_2024050322027&lctg=65ea915e31188d84ac041994

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sli.nypost.com/imp?s=124701116&li=54106&[email protected]&p=35257893_2024050322027&lctg=65ea915e31188d84ac041994

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1396	msedge.exe
1396	msedge.exe
3524	identity_helper.exe
3524	identity_helper.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3772	1396	msedge.exe	82
PID 1396 wrote to memory of 3772	1396	msedge.exe	82
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1360	1396	msedge.exe	83
PID 1396 wrote to memory of 1308	1396	msedge.exe	84
PID 1396 wrote to memory of 1308	1396	msedge.exe	84
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85
PID 1396 wrote to memory of 4292	1396	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sli.nypost.com/imp?s=124701116&li=54106&[email protected]&p=35257893_2024050322027&lctg=65ea915e31188d84ac041994
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a06c46f8,0x7ff9a06c4708,0x7ff9a06c4718
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1238143348044928285,5270328220043297391,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1320 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
3a034ba7605fbdd3ea4536fa722bd61d

SHA1
95b60519df5ba235769540efbb0784a7147688a7

SHA256
c90b33e7e2572384d6affef6809cd5382a0d032957c956daa61c14580e3e46ab

SHA512
59017d0a5f876fd6e3bcda08f0d3e911456ba3356d76ad80c0811de2b268909d79a4e375eeeb3342c108fb9e629d2221e2cdb2f0965c779d9cc2d8d064c5c36d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
376acca9dbcf3eb8da46b36bef6e5ada

SHA1
f6262fcb307e07181028f1c83524055e86fe89d6

SHA256
260bb4a31feac27869f2f1d46dbc6fc51f9120ff57803a9d8d1296a73c160ae5

SHA512
d7c2acfdd09e1c29cc56ead4fb2a2c934a359724839093f0db9af60582cc7649b3995acb9eb3065b049b312d0bdd2f6d7ddb2c79cf355a8a4ad3e5b9bbaa3a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
021a2a0164e46caabafffa3efa7948f4

SHA1
5e72a0da89c66e6220a87de22916f36336a7e18d

SHA256
4343b944c326f89fff8adab96d686f8943c260dd6d208c19bf9f833d2a404725

SHA512
bc431066b56e719191885e4d4913715ed708eb16552a58f9be6ec3fb44be433bc283b31ccd5b36b0647ca11ebe3007b1b976f965ae4f9554fae64da55b37990b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
79a12e800a41cdfdf75afc1e2c163b12

SHA1
89b0aa66f85174d2caffcb76e3deb9ee8aabde04

SHA256
5714b8aaaa55872244f3dba432ea3433d6b9077164aca3e491d7466a34e404e7

SHA512
9cbe5f54041a400e17eb8cdb2a180a9d0587e2fc6dbc866febe6b935056b50ec2696a8d34811798dc2790687ada88ec9f25575253c30f85f9d998b90943df42e

Download Submit