Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 10:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://jito-network.phoenixsite.nl
Resource
win10v2004-20240508-en
General
-
Target
http://jito-network.phoenixsite.nl
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2416 msedge.exe 2416 msedge.exe 2644 msedge.exe 2644 msedge.exe 1392 identity_helper.exe 1392 identity_helper.exe 376 msedge.exe 376 msedge.exe 376 msedge.exe 376 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe 2644 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 5044 2644 msedge.exe 84 PID 2644 wrote to memory of 5044 2644 msedge.exe 84 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 3804 2644 msedge.exe 85 PID 2644 wrote to memory of 2416 2644 msedge.exe 86 PID 2644 wrote to memory of 2416 2644 msedge.exe 86 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87 PID 2644 wrote to memory of 3304 2644 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://jito-network.phoenixsite.nl1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40f46f8,0x7ff8f40f4708,0x7ff8f40f47182⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:3804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:12⤵PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2716262760705236160,17963435635690925551,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:376
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2888
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\552130db-dc42-468c-a276-266c85c5898b.tmp
Filesize5KB
MD5dc47eb61a22c57301578da3fb349a5a5
SHA1a2b5ab49f57f45f21d676b282db0bee4a5ebf150
SHA25657590e09f3ce6ac0953af9a0c4343f8ee6cb30ca72deefcde8f18432abfbec1a
SHA51293743c77d71f6e1068ad7c0100030c5dab8a6026aea022287b5efdfa6289aa1e10816b730c7775c775d0265e9af22d4a0c40c34505a99d6b4d26a7044c6c0905
-
Filesize
711B
MD5ade5cd59aa413a56ec73c5f91e94da3b
SHA15c7c72eafff577c16e069259848794afc9faa125
SHA256ea1e7456fe0d74f93df11fff927c0e7c1011706e7d4e0a929c482a4f36045df9
SHA512ddd63f9858bb43866f7d24339ef8eb69cd5d544d729579100008c8442fe88f064f2703aba3b9020199c3089e8300da19661d39cb5ee7a400bf56b401a4c0fcac
-
Filesize
711B
MD5ca03baa7e2ae9a43e5ca02834d11a1e0
SHA1584d3c82dec58ea9f56abfda440d2be7e2c13d14
SHA256ce13407b83f6eba20ab0ff8e8c9b856cd880a6ba6f9569e280a05fc3cd629b1e
SHA512f38f152462bf358492e1309842933797974b607c48af3554f7a4819cd84dc8d6b0927cf0ac34310194499b9030e451eee8880b6248b63a04f89f0b14d6823499
-
Filesize
6KB
MD5444a0fd605a870ed5439e6542c459240
SHA188ffbf114075ea4e183a1c719984b25962330259
SHA25602dd4ee359c6a9718e41af190a537a6b03f4822eed33243f330f3d17fe4a6ac2
SHA512677caa26cb54cfd14fd4abadd5b8a39e2c14e6c12b2b9853ef6559374a476abb4da8dc51eb76cc02afe5c4b27d12105e2757de72080096db7a45ad25794f2bee
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD56329fe6046fe59519436af021d1dc7f7
SHA1e82dfd783931335467fd6c0fe30b9685c07889ab
SHA256e6d0a29b39152f459ce2b4171e866f7a6cd1d83df71cece059eb0c6b0ecd67eb
SHA512413c22c5a56905d72eb5c999844e48b265bc57b32879000b0fdf765083cda71b31210221cede5b02bae6f8c50218cd0d20ea3661b4f486c40bf9aac8b5e53bfe