hxxps://c791110b[.]396180e98c2b3c886b3635e2[.]workers[.]dev/

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://c791110b.396180e98c2b3c886b3635e2.workers.dev/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2040	msedge.exe
2040	msedge.exe
112	msedge.exe
112	msedge.exe
1952	identity_helper.exe
1952	identity_helper.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

112 msedge.exe
112 msedge.exe
112 msedge.exe
112 msedge.exe
112 msedge.exe
112 msedge.exe
112 msedge.exe
112 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 112 wrote to memory of 5052	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 5052	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 3960	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 2040	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 2040	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 1444	112	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://c791110b.396180e98c2b3c886b3635e2.workers.dev/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7bf346f8,0x7ffa7bf34708,0x7ffa7bf34718
2⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
2⤵
PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
2⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
2⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:8
2⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
2⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
2⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
2⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
2⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2144326229875608091,14181248877384775629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3404 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
21d91f347da303f948699857833809ec

SHA1
f775390b3a1ca1f09ca44164f0897e0331d574d3

SHA256
868b6e95a6ab3a5826c84aeed08847bfa29dd19bdfd8706bc3f605194e9d572d

SHA512
dc70cfbb194e21eaae113f2209462f42a34ada15141ee01cab608e7fc7fb662d958ec3ca36edeb13a800f56e262bb164c065d8da187e26b786cc2f82d8701eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
586B

MD5
6e2b7450dd097990c9804c602c4abaef

SHA1
505370fd0077fbcbed556207167b984d887c8ee0

SHA256
d6da508447de7029f0d30bfe786ef7d08cb8d82ee6608e3176d4d43bdf95a879

SHA512
9922fc5e78c953a07bb70a55add915c596f17034ee3248dbbf5a2c4352686235bc9238c384189b49abb6cdf0f82214675a5b614cc7a62ea71301b3e0fffdc789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d51eede44388795febbde38a8f2d01dc

SHA1
e31295f73f8814b79bf5e3524c35294925b98a38

SHA256
87f1acee798204f526bf16a34a2753d729b2c2a1f5eff0d8ab8a195029b42282

SHA512
72140abb94075fa77336ec1aec0f13e2853c376f982407334c0605e7ef92c6251229d646c55a229dec39ac7bdd3f0e5d91706550820b9a70d0919d24dac64a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f912604a5e74de77035e7f0cb2b09815

SHA1
18a7c5bd85e1e45e3c7a5532987b98c0e207b438

SHA256
5265a13d478604ecde4b4ffe856841fc8ea07f2e689d3498b472989756f4b2ea

SHA512
a21f195ff640699ef6c3c2d734ee414217062be024300234a2b7f94811bc9348a9f8d4fbdb01319ef096957cc0ea5660c93116ea3babfd073ed65c612d8bd2ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7717bc4d9c4bf2bfd9452d6c9bfab9f8

SHA1
fd3eeb76bacd6feef7647717d4d8fcc43358275e

SHA256
94e0773f4b68b09e3daf68b1f2cd9a4254ad754de1f7a95502f3f732ace78717

SHA512
4d42b87baf949e794bbcac2cf61e9fd791a6776c33756553871d517f411fb408dfd78282adf80553cefbd50e76979af229fb40a831ce31eefd2c2a40093dbb61

Download Submit
\??\pipe\LOCAL\crashpad_112_XTYRGKRAVNOIWKWT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit