hxxps://url10[.]mailanyone[.]net/scanner?m=1s935c-00076D-5k&d=4%7Cmail%2F90%2F1716211800%2F1s935c-00076D-5k%7Cin10j%7C57e1b682%7C12862802%7C10019077%7C664B5060CBC861BE1D39238268C02BE6&o=%2Fphte%3A%2Fftsueliulbqpaouer%2F[.]cmqeyenohxn[.]t%2Flmt&s=xosIt1DFYT48RDdFPNE2zR01FGI

Analysis

max time kernel
40s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://url10.mailanyone.net/scanner?m=1s935c-00076D-5k&d=4%7Cmail%2F90%2F1716211800%2F1s935c-00076D-5k%7Cin10j%7C57e1b682%7C12862802%7C10019077%7C664B5060CBC861BE1D39238268C02BE6&o=%2Fphte%3A%2Fftsueliulbqpaouer%2F.cmqeyenohxn.t%2Flmt&s=xosIt1DFYT48RDdFPNE2zR01FGI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
920	msedge.exe
920	msedge.exe
2068	identity_helper.exe
2068	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 4956	920	msedge.exe	82
PID 920 wrote to memory of 4956	920	msedge.exe	82
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 1660	920	msedge.exe	83
PID 920 wrote to memory of 2316	920	msedge.exe	84
PID 920 wrote to memory of 2316	920	msedge.exe	84
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85
PID 920 wrote to memory of 1220	920	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url10.mailanyone.net/scanner?m=1s935c-00076D-5k&d=4%7Cmail%2F90%2F1716211800%2F1s935c-00076D-5k%7Cin10j%7C57e1b682%7C12862802%7C10019077%7C664B5060CBC861BE1D39238268C02BE6&o=%2Fphte%3A%2Fftsueliulbqpaouer%2F.cmqeyenohxn.t%2Flmt&s=xosIt1DFYT48RDdFPNE2zR01FGI
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff61f746f8,0x7fff61f74708,0x7fff61f74718
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6729871985579849754,2022290913777149552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
0ab62d35e915c8dbb5a4ffc9c4c556ee

SHA1
93179fe5f3445ba99a2fc60069499232aad8f293

SHA256
d3cf41b393757e7cc543b4945647035a02eec300d2b97283cac82f848f6c1721

SHA512
ca92b7fcb8cc9a69af6ba7cde1bd9bde260a56c4e1fd5cc0317b3064908741092f9cfe3f8cbc89fda490b268ff7d680402639803f252abf478b555177ecb19c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47de112500ed25148b442c46a3728e40

SHA1
53793df191e8bffd66b29db93ae346df69f1b0a1

SHA256
cc0a1dee44a1e56824dc3083c1b14f2504527cc20c5fed37522bf478383e5dd4

SHA512
fc941e229a9f3892c7d169f3ec151bd6b8409c786ae68ec4114c39fc4d4ec9a120206dd95eb171847a8dc1dd666907088a20159be1917a7fcbd527b8126c7b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
82518a9db040e91f3146c2cdb0ab4a27

SHA1
3d0a4bc855927553a34526ba2ca9582d2deff103

SHA256
3c395816900860c9e01b53fc10cb170c08b784c64c10dfd0c2dae93c29a01393

SHA512
d352266ef91b0d4a0fbdbd600efab52ea33cebe1524c1ed0329e963a67f0f92226ddae9c1bba74a2e7fe73ca01892e1cc226919e6344cee4397a86d117c3db4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66b7629512c9ea501bee4e6fb44517e8

SHA1
b8fa7150f31d7edac48ddb1d830aa8ab71555838

SHA256
af9d6290d95df1c1006fda9c8161f185c8626b5d8942dbc2688cb96c9977064f

SHA512
0e9b7a812cb3446f74b004b93b1b441bbdb5a7027f92b4bf60f8fbb566f5a2d936c82082c6ce32ba5f67c332708bf9027364655e0d817a7db9b688bdadedc8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6b3b69d088a702ebca6d1a5680492f80

SHA1
5877c9b13f76113110c5a6b494058bf1d3fa2462

SHA256
1f3091091470c089d5961926463deab592ad4e14a3cd5d0cdadee8f217f0e90c

SHA512
05a864b88ec91640b7e55b49e0fbbc746ba3d67e567d4b7df740434f506007647713c08b126884a1a8458b9857ead38a691f2c077c701ab52d7f54371ee4ab1a

Download Submit