Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-05-2024 02:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://securemyatopayment.info
Resource
win11-20240508-en
General
-
Target
http://securemyatopayment.info
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 3584 msedge.exe 3584 msedge.exe 2008 msedge.exe 2008 msedge.exe 2500 identity_helper.exe 2500 identity_helper.exe 1828 msedge.exe 1828 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2008 wrote to memory of 2316 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2316 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 5084 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 3584 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 3584 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe PID 2008 wrote to memory of 2540 2008 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://securemyatopayment.info1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeec433cb8,0x7ffeec433cc8,0x7ffeec433cd82⤵PID:2316
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:22⤵PID:5084
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3584 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:82⤵PID:2540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:2180
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:2132
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2500 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵PID:2992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:2284
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:2644
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:12⤵PID:3824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,17781340344154178132,10404025579648177224,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5056 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4876
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4508
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50d84d1490aa9f725b68407eab8f0030e
SHA183964574467b7422e160af34ef024d1821d6d1c3
SHA25640c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e
SHA512f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50c705388d79c00418e5c1751159353e3
SHA1aaeafebce5483626ef82813d286511c1f353f861
SHA256697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d
SHA512c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
72B
MD5ccb401f7a55b39a2d88833867f0b2cba
SHA1207d149c431422bf2f00cc940ff194c67e445329
SHA256df73a8d4017092211093c394d60af63f36a60ef40a517984efd54ca0a50789c5
SHA512c290066365392122fc6dec2985b2bc1b39dd0396feead632a94ea594ef9c53505463081be77f1b246a30c067895897a03aed69fbe1b3753bcee7032fabc8c2e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
480B
MD5dacfaedd40282f5a18f0b418a93ccbaa
SHA1465e52704b863356e62f60d6dd824b95495bc92c
SHA25664033f4b2979224a390361a7dad29314d6b61f01835d06cf30001407e8c29b7c
SHA512c726e8bb84b73fa77833a5262ea801c43f43f849996b23aea0cba8a540788e7726197564a0dae95f741d612671ca442faa8feba9f665c2d63fb774eeaeea17ab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56a77b055b436a0503ba46ea62e87e014
SHA1e56cccd9a2450fd03d86da49434ba8670ff38dc9
SHA2563a65e58092b76888036785e2a4677b49fb1b7c0165ae0c32eae3121e47dffb99
SHA512925f6bd9774fd8903746ece21f9ff5484409da940928ab526d6809835eca68b45c741ed10cadff14b99bb3348d56c89b2ff331195d2cb68ac049ad7f2eca7f56
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD550a9ccbefeb4053d4358d2c443388be8
SHA1c5c8877c906ed3ab0be873c743950addcfbeae27
SHA2567790e4363f1bd30ec0d2e37cc700b581ab453c1c761c4ce7120f6be83cd87921
SHA51207f5f70dc1b0a36cce8950bcd792a6301a1ee952e63387b162eab7503d5d7fe149210cde6791244c7bd942a6ba8340e5a781e0cb1248d5593ad389740e97c838
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5f39ca4c311b26bcbd6ee654f7a145681
SHA1fa5c5651d401bb0f2a2c4bb7a29d8170bbfa9ced
SHA256042509607834334b621600d22628bc3d51cbd54a8d867fcb47af472a0d368b0e
SHA512856148edd994823618587d7d4f2a84814538791ad36be3874b16c1fa70ecb11cc64903087906a554a9388ebfb6291c30149ab5f046cd2209e6a32578f416b193
-
\??\pipe\LOCAL\crashpad_2008_PNSWGALGBUVPQXPLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e