Analysis
-
max time kernel
480s -
max time network
588s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 23:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bazaar.abuse.ch/
Resource
win11-20240426-en
General
-
Target
https://bazaar.abuse.ch/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 704 msedge.exe 704 msedge.exe 2444 msedge.exe 2444 msedge.exe 3644 msedge.exe 3644 msedge.exe 4864 identity_helper.exe 4864 identity_helper.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2444 wrote to memory of 228 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 228 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 4544 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 704 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 704 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe PID 2444 wrote to memory of 3844 2444 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bazaar.abuse.ch/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc50583cb8,0x7ffc50583cc8,0x7ffc50583cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,11310690556639362316,16191029563765474069,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5280 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5de47c3995ae35661b0c60c1f1d30f0ab
SHA16634569b803dc681dc068de3a3794053fa68c0ca
SHA2564d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7
SHA512852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5704d4cabea796e63d81497ab24b05379
SHA1b4d01216a6985559bd4b6d193ed1ec0f93b15ff8
SHA2563db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26
SHA5120f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
144B
MD515e17dc35a56f96f6e3ee64ea16811c0
SHA194196bc6e2d781f02dda8d641992bae6cf1aba06
SHA2569a0ed314625d6fcf9aaf417efe3bb356248a07f3c915a5faeb7aa9343aeaaa93
SHA512cd0a3758790620e15b41a36c9bb023a110ba8b6a84a44ee5d537410f2d34c5147bb5a77027b2b20a56c992f967f02aa132069ec87ffa97881532257b89cfb053
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
386B
MD5dc78bd0fff10659609774d081ebd22f8
SHA1b5d721d5847f2b3022b3200c0f09c13e92da9b4b
SHA256c48c50e1c4ba27ec144bf7e812970833bffcee4cee78bec0f1a258c0c6aed46d
SHA51220fce3144ea633fd6fa062a95d4d6575996ef5b9bc6e509959079c47dcd47ad976442c0d375bc70ff4ec4d8ffad7c710397c82b97110cea3c5cd31d2d5338bec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD50ecf33e75b9f965918f04e720320a887
SHA13696921d7b9d18a387e689fafa5e7cd9f0ea3abc
SHA25666ef2b0d9aab381b93d9e6af0599350bcf5fb0fa90c78fa6bbf57e46abef109d
SHA512e118b48fe21cc7dfe7ebca2178ac762938178e145e7591a0ed8a8c6463066e3823efa0560a5c63c4066e071e47415c38ffc8ffb795e9b5aa7a0e36cbba0230ce
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55cecb85d51c837f332673cd762214935
SHA1cb65a095bafbb08ccf981c0768473eda41beed04
SHA256cfa47ba5a29ca85423e43a6590a7fc5eef3a36a72275817f2dac150d3fb9495f
SHA512ccf6a72fd2726b2ae3b2ed11abee0befa73829f326400ac2788dcf3aa605f128dea7e7b0687cb74c74075b98cf0588855488ead77701e7fdcee56921f1a02da0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5caf6254dd9373094255be20ddef3214d
SHA1e24a88fec5efdc2a3d8ef89def590d9db7d4b50f
SHA25677b8fd7f192bab329b36207d93fb465f079a564ec4c7a7e3af1197613d1bac2d
SHA512b762b0638378fa53c97aa146ae3ce892cf5c78f9a5a2540c42338e3e39af68354ae7a0bf65302077db4beae201bdc2a77d9fd6ac4a634c2ef990f1d31f87ae3e