hxxps://sotapop[.]top

Analysis

max time kernel
146s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
20/05/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sotapop.top

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
72	msedge.exe
72	msedge.exe
808	identity_helper.exe
808	identity_helper.exe
900	msedge.exe
900	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 72 wrote to memory of 280	72	msedge.exe	80
PID 72 wrote to memory of 280	72	msedge.exe	80
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 1036	72	msedge.exe	82
PID 72 wrote to memory of 3236	72	msedge.exe	83
PID 72 wrote to memory of 3236	72	msedge.exe	83
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84
PID 72 wrote to memory of 4936	72	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sotapop.top
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdaa093cb8,0x7ffdaa093cc8,0x7ffdaa093cd8
  2⤵
  PID:280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15863901973293061015,3802956021260807778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d84d1490aa9f725b68407eab8f0030e

SHA1
83964574467b7422e160af34ef024d1821d6d1c3

SHA256
40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e

SHA512
f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c705388d79c00418e5c1751159353e3

SHA1
aaeafebce5483626ef82813d286511c1f353f861

SHA256
697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d

SHA512
c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
4e03c228b81ece68f9baae8c690aa149

SHA1
7f58a7e848064d7950c7542aeed51694ea6ffd00

SHA256
f74465c1c5c528d5b5ee33c804a8a361cbf43e2b3cc5ce2c50b32865f22c3662

SHA512
f0d091978fb46af4a7b8e6d1b8fbddbb72c734b7a999e2194ce6bedae31ed76a9ea2a833f39c580426cef85080b56b1d269611697c13dd204bc5b14ae5ba207d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
468B

MD5
0ed818a4e920be2405307dec3a0f5bbc

SHA1
7ef46e37fe2de299a646989ac96d117398802929

SHA256
3a647f6e1b81bd2f1c4a845030a24a246d75ebfc790f581c5b123631e38ec08f

SHA512
a77a2e5c8ad365b8f667a6fb7b77afe7163a88e74bc37b86890d72c165225e017c58b13c4448bb905081ba38d43ca3feb5165b6d75b7b42584b8323addc1d985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
98a4893276bafce7aed27a88ddbce55c

SHA1
45a33faf69617d05837bbfa4eeba629ad102896d

SHA256
c532e2c138754077fec9a7602d7d4493734125f6409870519974b363b194422c

SHA512
fc91c22167e1df758aa8a9aee3270c75c153af6b2675b0ec15f37e2f7bac96bb64bc360370d725cdae37effdc8e012925e5dfe4c6b4e4f91015ba0f924444169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aad0b694e8f2474b1113f4febdfae1a5

SHA1
6dc24cd30164e5844ffaa94826536003ad9f98da

SHA256
c549e8e91032c21113b28cb19a6357cf3bee72b946447c5c9dc0c4b6f551c71d

SHA512
580ddb8db79f0969db4f9dad8346db3080ba2a34090f24a7670533f9037b5a8cf9e5bd417ed49ba8c03545ac0615e15722d91170c39a564b21b63938a444b1b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
699b32af8165953fa6cd814983421d23

SHA1
92f366f40f193335f6fd4028bf4ac10eb9e84b14

SHA256
29e87ed5a148d53015849efca948a1a4f698bbceb905433c4fd85bdc9ef8f65a

SHA512
1f7123dae0d3b337150206848aa15f0c6416b02bdbacc2b78510b2f819f7529295da798ca7f1c27145ecdf1fcee154ff59ef9c660d62e17c95d515da53740f4d

Download Submit