hxxps://details[.]bio/hai1723-cheat

Analysis

max time kernel
112s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
17-05-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://details.bio/hai1723-cheat

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid process

452 msedge.exe
452 msedge.exe
2564 msedge.exe
2564 msedge.exe
3272 msedge.exe
3272 msedge.exe
1656 identity_helper.exe
1656 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2564 msedge.exe
2564 msedge.exe
2564 msedge.exe
2564 msedge.exe
2564 msedge.exe
2564 msedge.exe
2564 msedge.exe

pid	process
452	msedge.exe
452	msedge.exe
2564	msedge.exe
2564	msedge.exe
3272	msedge.exe
3272	msedge.exe
1656	identity_helper.exe
1656	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2564 wrote to memory of 1288	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 1288	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 4364	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 452	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 452	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe
PID 2564 wrote to memory of 2708	2564	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://details.bio/hai1723-cheat
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffef8683cb8,0x7ffef8683cc8,0x7ffef8683cd8
2⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
2⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
2⤵
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
2⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
2⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2392 /prefetch:1
2⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
2⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
2⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,16954736824935623698,14174453567338627923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3916 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
794B

MD5
3faa5cdff8298ccd0ecf0cde87bd0a73

SHA1
83c2b37f70292b78d3bde1d27835a8838321d14a

SHA256
c7367c8f4f6dc691721724e87a78c44274605c8b968c30baaf6de495f27dbcfd

SHA512
5c5e0ddcaf93da68d88fe4f9f02ff213963094306786b90c1539c48639259b65c040be8e5f2aeeeb629df3b087e8753fd406f1fe82b991ee20e27388e6c1f675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
856ca03ad483054493023ea0256c9551

SHA1
f410a54f3d7b2c07b2a5bd2db79aaf54ebcb4bd1

SHA256
a7d0ceba27783490d4f5709b6be8b5ef2d829cb7d15f2a69b5953426227ee078

SHA512
e20a0c17de37754d30aa5dd40f9329a4b1aa50fbb91f7d352f3167d012d4bc067c9d256f5cb68849b20d2edb2b802265bfb32a6f898a00aa2d06ad018d9c6b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
27abd39f14713c5b718a51a11cce70c7

SHA1
910f4d73389964cb6f0251a6560960aab12f1ebe

SHA256
a8d2074e17a0ee161e38eeaf142b73961702bd31816d0a57d6d5def2ef953614

SHA512
a730f13cbfb661c317971d0a04844886b735840f77fb0fdee132ff906dfe6b21bdec45fa7365b64b9a2efa5294d6796a0fd8c667f7430407300ea6759e1b5d2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1d3158e35517e70508da028247c2edbe

SHA1
5aeb423e9b37b3dd77f28b8e10d9e5f68deacf29

SHA256
b222e9fed173745152a229a4719c80281a56a490da78d398dc120dbe8d969d19

SHA512
4ff1c29a2d1af10840cfed74d6e78ed227e8a0f2c738ff8cbfb6fb1ba30c93b3560c2675eefb444f31a29cfa02f728822e378775e0f2c2dbda068b254a3b66df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c1de47195a7f46c89ea0196939e7d58d

SHA1
406e49e8864b59f51a7294783a210b05f5fdd1c0

SHA256
28e3c7549a41aeb70097b5cad6f9214d65fcf73f11b5618a78d3152102e09613

SHA512
f1c6bd17a14be67a559fb5c06ecf54323d34bf5b08b71958a7ccd33bb7179fd5db4a2108239bbf05de67767cd784cade49acef279dcc658b657574e7178ab992

Download Submit
\??\pipe\LOCAL\crashpad_2564_NOPFLDURFAYXUIVG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit