Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
Secure-payment-docs-492033965.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Secure-payment-docs-492033965.html
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target Secure-payment-docs-492033965.html
- Size 424B
- Sample240527-y939eahb3v
- SHA256 f643de991a5be40bf5d585a2692e82b06943ba3449cc2e5e573d298b21ada5e1
- MD5 92316419a8a736391917abbcea33995b
- SHA1 2b601756437f83807581853e27d6c7c09ac9305f
- SHA512 d13361255fc8eaf6d3a3111716b63fcf73777af4a7ef44ca54940d6db26d9fa366373532d390dfc1ac6ec4d19be2b4c593ea8366a0a62d1980cbfbc3a6d81647
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 19 href.li 20 href.li - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 74 ipapi.co 75 ipapi.co - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 652 msedge.exe 652 msedge.exe 636 msedge.exe 636 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 636 wrote to memory of 4488 636 msedge.exe 83 PID 636 wrote to memory of 4488 636 msedge.exe 83 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 4440 636 msedge.exe 84 PID 636 wrote to memory of 652 636 msedge.exe 85 PID 636 wrote to memory of 652 636 msedge.exe 85 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86 PID 636 wrote to memory of 948 636 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Secure-payment-docs-492033965.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffea6e846f8,0x7ffea6e84708,0x7ffea6e847182⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:12⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7131876438967767901,17646646279082298070,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1748
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 240B
- SHA256 0b89939e778c82c4c3c7337835d01c850208d3c81fc1d20234a96911b73a788f
- MD5 0afa2a4ed2b8a381bc1d5dbce699abb4
- SHA1 b7e5283ca2e2ae60b40db3286790dbb9d98f4f71
- SHA512 ba42de1fe23b2f5e547e49154a5b9c2d982ba7107a55878a05dd47410081a4c5fb464184d51872201017e800664ccbfeebf9dccbf7c3274212dffac560e998a0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 1KB
- SHA256 59b8cb7809009befbabb1baf89d5ece9671180cedba85a76290471c9b310cb58
- MD5 899af70444e86bb7904e5de63b467375
- SHA1 ba81d250130eb547f353656dbeb4d419028e1418
- SHA512 9967b770eb49ef5f8b3fcf731191c962276b66c4fa299880cf391ece8d5f10045696a57e4beb492b3d30bc20633e508faf9658dff178144ff17e2efe08020489
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 3a3f98f97f1aa0fdd1ac443a92fbd3c0c53fcbb5b0b1359427414b00b22a568d
- MD5 4fe64a2c205f7d56a5be57bda112e195
- SHA1 7ceca2702c3f725eafa2e9b978e0bc385335929b
- SHA512 bb0205daf24656895b9a236c289928784133b6acea751db4a5f924cd1e406ce2a29505c4d8bb67886b7cc3e1a67df0643f25d50d1d4961d1b4c6694a7b0706f0
- SSDEEP 96:nnkiVm1lD1wpvWMoiVmdeHBrzSUWQyV+VDCziEwb:nnkGmH1GWMXMro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 05e46f5e49a4384cd3463bbcd21aced4cd5e5b1f2cf272f8df478b2bbb482465
- MD5 c1a414ed45d226390a9fcb0978a63aef
- SHA1 8327fdd5e2660ab094237f4d0560d722b5fb94d2
- SHA512 fbba77a51b79bc754496152d25cee636278e12704154823674b1b29e6a7994a6bc4743611452e0829de670b0491ad318519af735340ee8d9ec6aac64d972d065
- SSDEEP 96:nnkZVm1lD1wpvWMoiVmdecqBrzSUWQyV+VDCAiEwb:nnkfmH1GWMsqMrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 799014cff081a206265fa4f1e698dd2c6d48094ed7318a1a7fa830e5dea6db38
- MD5 41c08a0fe6741beab3c59e9299dad5d4
- SHA1 cbd8fdd607281b9521183780a2ccb70f893e094c
- SHA512 1ed5e83eae2860c16ae65d07e8b00a1f7d7cc5b6a6e4f606f93e2cee55f01dc250c4607f67c0c67cb7988108da48833eefe94e9e2d4ffc9811a35c3e0c7845a9
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKH7Me2RU8MC2Nx3z2OMDCP:A9iIxuERzA83h09RZxYKH7SydNxaOMWP
- MD5 SHA1 SHA512 SSDEEP