hxxps://hallenge51[.]cc/invite/i=63719

Analysis

max time kernel
50s
max time network
49s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
15-05-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://hallenge51.cc/invite/i=63719

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4400	msedge.exe
4400	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
932	identity_helper.exe
932	identity_helper.exe
2256	msedge.exe
2256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3108 msedge.exe
3108 msedge.exe
3108 msedge.exe
3108 msedge.exe
3108 msedge.exe
3108 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3108 wrote to memory of 2176	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2176	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 2056	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4400	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 4400	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe
PID 3108 wrote to memory of 3216	3108	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://hallenge51.cc/invite/i=63719
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff30433cb8,0x7fff30433cc8,0x7fff30433cd8
2⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
2⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
2⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
2⤵
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
2⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,15641017081997134649,6476062178988787652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
2⤵
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
de47c3995ae35661b0c60c1f1d30f0ab

SHA1
6634569b803dc681dc068de3a3794053fa68c0ca

SHA256
4d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7

SHA512
852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
704d4cabea796e63d81497ab24b05379

SHA1
b4d01216a6985559bd4b6d193ed1ec0f93b15ff8

SHA256
3db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26

SHA512
0f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
9eedeb219d0d0bda3051d0d5deca21ef

SHA1
9d31067ee246e7208da4139c8b0f54bca325529e

SHA256
ca709538b490238ae72a8d3846f64710920acde3bd95592b8afa776f610fe10e

SHA512
de8b225986c78dd1d5a5177e2022f05823fb8e43636d6c341c5d71a4080997413efcffc8dea24a90c7c7ef6acaaf0f9718c2be8aa442a922ccd8cb9d2ee9c069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2d85e3b8cf4eb699887cb69d2de66113

SHA1
2615ceec3be6a3432d2bb4d54611c4015834bccd

SHA256
f2abe2fc1219fb2c1002f37f4c7bfd7c6eaa5d7f3f5bafb4dd00400a92ff9f83

SHA512
350832e4286da8796ed41d43b14941348e177606b7b9224da6c7a62b26e9487b1bb84cb63d6097882966dffbf64155cc96d4956a6d843cb6d4b0c11f91fd7884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
37074911c4a4b4aeefa8a8e56903019d

SHA1
e4382d05ba8fb30544360f2411d869d2d302200c

SHA256
10cf33d209c593c20cfb1b7622c1afea0b460a0f8d165c7e0e26527a9b1950e2

SHA512
b3dfbc317deb545900ba4af17841efce00d5265a63f70d223d00c18bca9201cc71d6155c2718a27a1860da08d25a347a9b4cd6f09f8bcae3cac99ba3fb311816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ed833df061ac293bad68b8e4566b7de6

SHA1
1db326cd2d8674449615dfc2c685b750234152f8

SHA256
aec5a22d27524b707e711b422e0bbb7b48fd10ace61bdb461c7386ec01440185

SHA512
9418e7e465ca78acf652ac81a3648769e2f4a67e4671c649b116146f3ed0f78afa25b832452addb0b3427ebee6203704ce2caee95985e8527e74342e97547379

Download Submit
\??\pipe\LOCAL\crashpad_3108_QITDUSGSSFPLQXKE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit