Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 07:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://us17.list-manage.com/survey?u=cbd39921843d8da551f3a4214&id=1d48abbe96&attribution=false
Resource
win10v2004-20240508-en
General
-
Target
https://us17.list-manage.com/survey?u=cbd39921843d8da551f3a4214&id=1d48abbe96&attribution=false
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1724 msedge.exe 1724 msedge.exe 4056 msedge.exe 4056 msedge.exe 4012 identity_helper.exe 4012 identity_helper.exe 5004 msedge.exe 5004 msedge.exe 5004 msedge.exe 5004 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4056 wrote to memory of 3780 4056 msedge.exe 83 PID 4056 wrote to memory of 3780 4056 msedge.exe 83 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 560 4056 msedge.exe 84 PID 4056 wrote to memory of 1724 4056 msedge.exe 85 PID 4056 wrote to memory of 1724 4056 msedge.exe 85 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86 PID 4056 wrote to memory of 1856 4056 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://us17.list-manage.com/survey?u=cbd39921843d8da551f3a4214&id=1d48abbe96&attribution=false1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed44d46f8,0x7ffed44d4708,0x7ffed44d47182⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:82⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:12⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:12⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9451851324874469460,12457297736331506548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4324
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize240B
MD501e58447046076cb0bd9c2cee388ba56
SHA11f49723016a2cd912e36b5902c85abb8b39dd4b1
SHA256186d0f20850cf720de42dd5a09f0105a933231567d7bfcd78e961611f42da545
SHA512483b0a989eb1138cb8497720badfc87b71007f7c10aa987c4ed7849cc28bf42aae72cfe987a2685373af1b1a139350ec47889ce7d7bb406d3f5ba6c3804864bc
-
Filesize
1004B
MD5b9fcb7001158519435219313bf1fdd4f
SHA1cfe518c51c7facd52623080599fa0e60bfc39148
SHA25601da8aec4b9f2139d52babd9dca5b4324561250393027e3432b2694b99e43741
SHA51270cdd2b0531965420b28364808979a9544650070dc947167b53b91dfb9e45023cfe687854a464a98dcc416f9310962637f7a06f823348387c9e9ce33ef218f14
-
Filesize
6KB
MD517e38dbd71b006a71661fd44e3f5fae5
SHA1895fc1611e79192ec7b63442a5cd9384d9b36cb9
SHA2567921394c7c2676feee60a599c0ce39f0b0737526815586d4467f6a78537e62d5
SHA5126361961ad2230120f32eeea6f02d1b8b35c65db2543d9b269a63f7276bd6263cab6e2e04be8f9dfc40d4ffe5bb902f2b7187dcaedbd920c19f26b985bb1baeaa
-
Filesize
7KB
MD5c10aaf1c0659a49dc8bbcc9acd517056
SHA1f1892b70fae14eeb5bba48f48a6a917e3713c2bf
SHA256d5cf550092ead63ce3be46d0fd32343524204bd917376b461114009eaa921c51
SHA5122b271d2c304f183168d6e72b95c6a9b716604414f7b796f7d30625414481634c19f0ec25637ae3eebb5adebf6f366b5cd74ef94e6c6c88e15a91a8d8aea0e418
-
Filesize
6KB
MD5d8f77d2a595823ffd5dff07595435e10
SHA1094ac734cef3161c5f246370b7ab17f04b20549c
SHA25644640955c5644e63873d2330fe027e0217a4c30fa76c86c10bbb06c3e80b0e96
SHA512cdb5b612c26878288958fe1f9e7f28607f0553820bbb7eca300d18a81c2abc0e671132e7baef177b3ffa84ce758b959179228639b7f5ff5b352885dc05880718
-
Filesize
372B
MD5b14ca3c76c9d7e520a1e92f16f9e6a60
SHA1ae706aed3844fbd93c2fdaab68520b95d4d01425
SHA256b29ec4cd452071bb4eadd3f71a5abc3e820eccc26a257dc84747013f0590b60d
SHA512a849913be6b7cf1abea7f6c3c93e3e310ea26eade52ce1463731b5983948d11e544fd2723b3d06eb3c82d926e13cb1136c481008701374cdcb641fa66f9d9bb3
-
Filesize
204B
MD5b8cdcc77d569c19a98f334d1f9bc11df
SHA18bd64ba4305e618cfe97efa8f931cf0b5a4023f5
SHA25686166da4d298a35e30962ce49959a82eeb58f65e24d469c33095040c63a58f91
SHA51209b0ffc2a3314dbb85de49b3e2f9fda77c5affb225d84673d19574f2bbf16a7ee542c48bbf322ae06f638ca4497c3be1a83114c834ef9e7c4e484a05fe0ac78e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c3e7e813a9f84aa9452eaa05eaa877e8
SHA1e674719624a4c9ad886a356bbea41fcf64a7cfda
SHA2568e0a74bb76cad249e5d80d9df956d8ce2a3fe95f3685a066a3c0efe888b481cb
SHA51292b23eb55590df00b5650375f653fe00d10fa14de53a392e5265f9ada55a26efb8728232b038b486a529e2980aa2ea1dc6241f1cfe30a828e54821bcacf2b386