hxxp://orthopedistdokterdegroof[.]be

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://orthopedistdokterdegroof.be

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
5072	msedge.exe
5072	msedge.exe
2140	identity_helper.exe
2140	identity_helper.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2732	5072	msedge.exe	84
PID 5072 wrote to memory of 2732	5072	msedge.exe	84
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 2080	5072	msedge.exe	88
PID 5072 wrote to memory of 1944	5072	msedge.exe	89
PID 5072 wrote to memory of 1944	5072	msedge.exe	89
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90
PID 5072 wrote to memory of 4784	5072	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://orthopedistdokterdegroof.be
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe6c446f8,0x7ffbe6c44708,0x7ffbe6c44718
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5813536622366045003,5613941389742307008,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87c43438-e420-444e-bf73-28e892a4aa89.tmp

Filesize
264B

MD5
b0344c00c99541c4cb20aaf0b199f4c4

SHA1
b435a08f4e59106284ac5c1e1ca108441e4cfc17

SHA256
7ac8221ee0d010118145bbd5ab37b2e5c934c6c26115274b14451e138a5643dd

SHA512
dc4a5f6d1ce8b97e4fe87a52444c5fb7907653eddb85354112f6ef0df7b82dea910dd0d48000524d27da26f9322e4ac1543f137c26ab374be96aadba95b2258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
791290d84e36edb152393356f2f86230

SHA1
2ef836e5e89d4c94976e403f1d020e2ad5293388

SHA256
ba4e962ba3ddcde17fe2878217e38a63e5f272db0cc889e02319f27969029ff1

SHA512
49cd3e9d513dfe94584937f96a58e90eb7cd9b16621da2f3078e58356e61fda7aac9f184eafb85485c4587632e540e141f17cf0dfb43944dd43d6a502b474fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
553b1ddf929860f1178b19a9da565b11

SHA1
c9646bd884b964dc9c9ab99d7250b2c52663ccc3

SHA256
1e985e650b19b5af112d15830db8f443e4f11a45769242a228b51d6c58611f35

SHA512
663975c2835cf3c73a6c2685aa6d0209da90db2f3e8b0216f8c849ffd045c215ae3e6e1a9b4b83d58bc3643e45ddbd9ae3a88b1b78d3d887d23fc2b9968da554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19d122dd4ddcfe784ec960dd47830a33

SHA1
b1eb85c1233534266d75b9e8f1653c5e7c4e0f78

SHA256
200d52069ffd3e13dbe4b26483b7d278e55badcc2fbf94b67698a349f7979cb4

SHA512
a24a7f5375bf1e34f4eec65c2f80e0b709ede399043302e174da09392578fab9b2c7babaae5217a506f9d95d0012226925689878c073282b823a06f33199d952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
277c8532b80bf94bc4afd9fc6b421575

SHA1
5554604a7290d1222293769daea4a0cb98d2006e

SHA256
db3ea04963cb96544c3c5ccf000fc81d45b4dabcb677cdd60e565bada189dea7

SHA512
573fff255e78dc4ebc55f64c046580952f3438f110749e543ddff16915572fd875358fb79ae73a4c0a910fc63f3f55f5a06ed64642b376733c452f2cc62947ae

Download Submit