hxxp://elink[.]mylifestyle[.]au

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://elink.mylifestyle.au

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
3164	msedge.exe
3164	msedge.exe
3728	identity_helper.exe
3728	identity_helper.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 2300	3164	msedge.exe	85
PID 3164 wrote to memory of 2300	3164	msedge.exe	85
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4524	3164	msedge.exe	86
PID 3164 wrote to memory of 4592	3164	msedge.exe	87
PID 3164 wrote to memory of 4592	3164	msedge.exe	87
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88
PID 3164 wrote to memory of 2464	3164	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://elink.mylifestyle.au
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffbac2346f8,0x7ffbac234708,0x7ffbac234718
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3826570019810869774,3991863393269295017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
955776a71d690674c5ca3772f811f41f

SHA1
89145ed57054740cc4a711ce3b4bc13ef8d6f4b4

SHA256
7310b1e238d505729c34f50653846bc10e8bfe1394420cfe21128cff40d2365e

SHA512
b28ede6da0bf8dbf5ccf6a5fa3fb6ec4208cf50499049ab69aeae6f1d61b3ddbfc712656f504255e0b0857c0cfd37e7f95c3229caa9bdb69278597085d5208fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
887B

MD5
8c816ea4ff780e89aeda31887beb0865

SHA1
4673adf84cf47866c9056415ee3f3a463dfa6eda

SHA256
d50b22b051fb2a622783ba5f3cc03be1d1bd734982f205c232e9c89e4bb38481

SHA512
c8909a0bda490637bf86accd2fcf9e4aa8317d85cfccd038e479b256d3dc1691a085ee677f795de6d33dc3c079da151452821f64cd1ddcb5f914bf85f102a700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6347f75f522353aa82b9737314f20b0

SHA1
99b0b82c3a2c5b23428a74dba0bcde723efc6526

SHA256
c1fadf3831aeacdd860e2b83b82cc5009627a924e01bb5c2635bd3ca524255a0

SHA512
382abed1affe3c15cbf439b067924d38bec4df9aae3bcd361f5096dd6f64118d1345baf24f2a02a26dca0ddd13f5b6025f541114a4c1ea73d3a05592dbff03d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e55db80803db8130502b9091e9d23b47

SHA1
829611bef808952b995a5f329f6410b91b07f771

SHA256
f08be728ebae309a4e0742576d4a15ecf8a108c64d46d0c84a1120332361d2c3

SHA512
b117095c7e50a737a75095a0c3c93d377e055761dd2655739be6aae3035171ea3200860352a08519e40695212f0173136ce94f5a47d37dee0446c6617491dac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ec2ac5d5f4ada6aace4ca49c5ec34b81

SHA1
e6a48fd922f4dc6a12cdb26e9b190285a5fa4715

SHA256
d9000ea99f714fd980881c4c54bf9c7229ed9d3716ce2513fdacbc85193a5915

SHA512
1bc3301a097d007934cb240a5450ac31bd2f4fc3121fba1109a128b2f04c52f26316f6c8909bf9160ac313d516b2bad801d615cc68fa34ffe7e68dfaabcae076

Download Submit