hxxps://shop[.]app/help

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://shop.app/help

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
4164	msedge.exe
4164	msedge.exe
2736	identity_helper.exe
2736	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3316	4164	msedge.exe	85
PID 4164 wrote to memory of 3316	4164	msedge.exe	85
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3200	4164	msedge.exe	86
PID 4164 wrote to memory of 3168	4164	msedge.exe	87
PID 4164 wrote to memory of 3168	4164	msedge.exe	87
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88
PID 4164 wrote to memory of 1008	4164	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://shop.app/help
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd150d46f8,0x7ffd150d4708,0x7ffd150d4718
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2976630064689321063,2693487851092497478,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
0438e923b38714c2efa366f6f6a9034b

SHA1
ed965451b00bc37d73775b5cbe25c47e4d9f04e1

SHA256
c9edda0813edd17c3946bfb1e0b2049f403a9647167b4ed07eaea3af962dd6c9

SHA512
1e965cd35327b2dd0770f4c71fb744534307f68760387540c220edbd3374463aeaecdc6a5beb7f543d52897209410008968743a6b3ec95984448111962318dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
abb9ccbb735d188a8cf6f8a369049ce2

SHA1
24b48e2cda229c273c40c1bebecb4850ec60280b

SHA256
a5f9a2df14e058c94d17eb550a61fdd548d9cb953e55b55f1d812de8a4066785

SHA512
60f9229066a1e7d73d6c4fa35bd6d043ca97a1d2c71e7a45715d6a5e0a1222928bb429c951be30b1e1d2bcece2731efad96906774ecc400267e885e47a717c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
046a23fdcc41f8132ce3c90550d918fd

SHA1
aaa6745df0aa58d9819043ef93bf8443e17c20fa

SHA256
955e89742b33888de73003b7caeb7d12edb7e808a018d0b1878f232106f22fad

SHA512
997ad41300978dcd30ef401ca98037d6d5326b7cb492c3000ae71f28c9e9d84487066eae6cb735ade226c1eea1fea83d157b3d6a8a777733b95f391be0a9168e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edbf942870ca4ddfb9c3e7466313e7d2

SHA1
6f689fc0769991d28655d272847a9a9a21e5821f

SHA256
c4e6081b101634595b99228081adf5e86b663da15248a4d7b3a23a2bf1a44a60

SHA512
1ba9d0634bf3ea4f8629c014961b462e1c1ae5cf3e58619a2ea8563edc85f795a0db36afe8fd1cde9673c301a4befe542581c942a5ca87679fe8218ccffbe164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9e81276a539b58fa6ad7d0c2e9759ebb

SHA1
e49b6028d8c3a9f5e2eff4e641ad4fbc8aa4fd03

SHA256
76d04f00032699d53155ecf9a0385de05d3f82a59bbc227915388c603a9c0a61

SHA512
60e90937e1898468dc58b4c42409a58504ed67b68c2862d330be85f4392ce8d0dade908c3ddbde4621e11f8cf0a3d53be601a137ee2f6eae88d0d03c42ddb82f

Download Submit