hxxps://url6[.]mailanyone[.]net/scanner?m=1s9UFM-000CiC-67&d=4%7Cmail%2F90%2F1716316200%2F1s9UFM-000CiC-67%7Cin6e%7C57e1b682%7C26023477%7C10839452%7C664CE828D09A29E749862A491AAAC3E1&o=%2Fphta%3A%2Fptspbinrllytaonozz[.]c[.]oeigc%2Fa&s=IY823YGYdPj0VexD71Fh81X9-uM

Analysis

max time kernel
249s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67&d=4%7Cmail%2F90%2F1716316200%2F1s9UFM-000CiC-67%7Cin6e%7C57e1b682%7C26023477%7C10839452%7C664CE828D09A29E749862A491AAAC3E1&o=%2Fphta%3A%2Fptspbinrllytaonozz.c.oeigc%2Fa&s=IY823YGYdPj0VexD71Fh81X9-uM

Score

6^/10

Malware Config

Signatures

Legitimate website abused for phishing 1 TTPs 2 IoCs

Phishing

T1566

flow	ioc
7	url6.mailanyone.net
9	url6.mailanyone.net

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
4688	msedge.exe
4688	msedge.exe
4840	identity_helper.exe
4840	identity_helper.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 2712	4688	msedge.exe	81
PID 4688 wrote to memory of 2712	4688	msedge.exe	81
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 364	4688	msedge.exe	82
PID 4688 wrote to memory of 3416	4688	msedge.exe	83
PID 4688 wrote to memory of 3416	4688	msedge.exe	83
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84
PID 4688 wrote to memory of 5016	4688	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67&d=4%7Cmail%2F90%2F1716316200%2F1s9UFM-000CiC-67%7Cin6e%7C57e1b682%7C26023477%7C10839452%7C664CE828D09A29E749862A491AAAC3E1&o=%2Fphta%3A%2Fptspbinrllytaonozz.c.oeigc%2Fa&s=IY823YGYdPj0VexD71Fh81X9-uM
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc0446f8,0x7ffcfc044708,0x7ffcfc044718
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15466059334959567657,1403323682299719139,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
479696f8cd98c8dad72991ef91e59fa1

SHA1
9c1f69b3b1273d24574fe2b453a7a2d4ab2352b1

SHA256
b65376eb7f00de11f1c3928e409cdf47015ed5883ea01b91af97ce15bc36ba7e

SHA512
14000841b28beb3dd5a3fac9c4c177f4edd3d2fd2e77652601fb0523287dc278eddd0d7b1de0173f86450217351bc494efd46a2c108552c4c36a831435249ce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
187B

MD5
486f400ae50287ac2a2f8f8a53faa6eb

SHA1
5a372314e3b7c8a679cc42914b896541c50d307a

SHA256
f79d5e60b0f7ae8b916f54b001d3b602e6e7cfad1ef7f265da2225619f3f9850

SHA512
97098722a323c6ccfcf51d835bde74afc5f614589ca013a73a7297a8b6c0a00ccf48256fcb239040bc70a86c92d90249ad44fafc8e938dde0635146775128319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
baf20c0c753dbdf3e06a7123c57870ff

SHA1
2ef294b230e88be3f107b26bee08cf3b1c1efa7d

SHA256
2e8d1056633ffe71fc20ba1f0a1beac0eade572ad59b916b89005983ffadd22f

SHA512
d552ed06fbb7fa7ce52059cc2c8fd2e813083b0b3596e4eac1e37bc9da5325cab070ba64f17f39ce6a5be83e3e96be13b2b1ed508d57367c8fdcba3fdd788955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
600e293277c74763d7e5a765eff2740d

SHA1
be8e140467bff540e1cd2ed79e52cfaeeda84e58

SHA256
8739717ebf79f0c8a4b124be243a764a8aee25da3b584ec77b48884ba0ecb863

SHA512
24e64f3f8c4cb211d4efb645d7e19b36156cd72a0f360ff239019a9106e7ccd3455ff5f91f28bdfa618321820e1b8abbde9e0c9bb4e4d81d9167b1677160d574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
454e15ee0f6f69fbd56464c0a3feddbc

SHA1
932eb37277d62d270bc3630504149d6eeac403d0

SHA256
95da9954ec9e6b417461048b5209adf4a7abd41158f5ff292e624606815eb1fa

SHA512
c93903657f1a28f8b3e8a85ac03a432689adce883d34e6fb0ca7611ed93420c7df5e12b76c095edeb830de53d5e2e0161682e156337169f33928e8a08a2165b6

Download Submit