Analysis

  • max time kernel
    76s
  • max time network
    88s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 08:05

General

  • Target

    https://url.emailprotection.link/?bfTS_KrNiCShMSk4JMdvONeCZogDcLbz5FpmqaWv5_rv04QOH9b6Kmd7I2qCiUKsv5q5t0vck4irt9qK1Ha4DzFeAO0jjH8TqkD8_rnXp7Hb_Z2NvhP5RRBPj-wTHvqzH3uWgwkA5ntmGsn_nQmoSqXg9ZA99cuf-YoREOfJYdxDOydNBrZanG4AjtkOBRG8jIYlVsNNW5m0VQXzj53pdlrIuvxEIXshgoyxys-1O7YY3TXyKX91l31dM71wVeSwnEfdV41Ae6S_Qz94sYwSpHTmtde2cL52gfFzC2-9V1C4uP_zO_-8UqGHHy_EuldxFEsUQnyqSjqeNOcNLtDKqZk_YFZPSMI2uoVDXHMIsE7bzz0WyMM5JE8h_E3PM6G3BXBxylvRaP9pgn2SUBMmD4MikUNFlgdO8l0F2GTjTWZ1iamreK1TgsgJZU5n3HdhTP-FR-6GO9e5TUim70dwnMYLSymCeNheZWD28SdMdEq15nmik9cacgtLBurT14jJh_0pROu_pGf-E3UrWHRr0UA45EqC2EJESTkvmRpfgvknl3VTE5ALfrvQt-vml8LuHw1iE_hpL4YS9F9MIqs1-th8X3GC1yR0LkfTTrX5edJxG-rlLXrryMntFIA_PAflBl2-kK2SIlZGVNYATnrQi9yKbK70wOUwPIQn-b83tFxm-yj4nvBfB8LMAJkc9C9odqhAaLU1pgemaAlR1eltYR_00Ujep2NF6a4onO3YUQA9N3PhobVIQ7vswLz4pwyXUAjlowSupgC3RBx3ll15alNvnU9ORi5E7VwgP0vO27L_HSOZWUTwe_kS0iMHUWAbg4aTAUCAyg2uGKp28eGvIdJcxffqxabruTMd5AaFmXlDEU6yKi1DztscBp_z_GWRo

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.emailprotection.link/?bfTS_KrNiCShMSk4JMdvONeCZogDcLbz5FpmqaWv5_rv04QOH9b6Kmd7I2qCiUKsv5q5t0vck4irt9qK1Ha4DzFeAO0jjH8TqkD8_rnXp7Hb_Z2NvhP5RRBPj-wTHvqzH3uWgwkA5ntmGsn_nQmoSqXg9ZA99cuf-YoREOfJYdxDOydNBrZanG4AjtkOBRG8jIYlVsNNW5m0VQXzj53pdlrIuvxEIXshgoyxys-1O7YY3TXyKX91l31dM71wVeSwnEfdV41Ae6S_Qz94sYwSpHTmtde2cL52gfFzC2-9V1C4uP_zO_-8UqGHHy_EuldxFEsUQnyqSjqeNOcNLtDKqZk_YFZPSMI2uoVDXHMIsE7bzz0WyMM5JE8h_E3PM6G3BXBxylvRaP9pgn2SUBMmD4MikUNFlgdO8l0F2GTjTWZ1iamreK1TgsgJZU5n3HdhTP-FR-6GO9e5TUim70dwnMYLSymCeNheZWD28SdMdEq15nmik9cacgtLBurT14jJh_0pROu_pGf-E3UrWHRr0UA45EqC2EJESTkvmRpfgvknl3VTE5ALfrvQt-vml8LuHw1iE_hpL4YS9F9MIqs1-th8X3GC1yR0LkfTTrX5edJxG-rlLXrryMntFIA_PAflBl2-kK2SIlZGVNYATnrQi9yKbK70wOUwPIQn-b83tFxm-yj4nvBfB8LMAJkc9C9odqhAaLU1pgemaAlR1eltYR_00Ujep2NF6a4onO3YUQA9N3PhobVIQ7vswLz4pwyXUAjlowSupgC3RBx3ll15alNvnU9ORi5E7VwgP0vO27L_HSOZWUTwe_kS0iMHUWAbg4aTAUCAyg2uGKp28eGvIdJcxffqxabruTMd5AaFmXlDEU6yKi1DztscBp_z_GWRo
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffca1246f8,0x7fffca124708,0x7fffca124718
      2⤵
        PID:2280
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
        2⤵
          PID:1464
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3512
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
          2⤵
            PID:2092
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
            2⤵
              PID:2940
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
              2⤵
                PID:3624
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                2⤵
                  PID:2040
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
                  2⤵
                    PID:3960
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
                    2⤵
                      PID:3052
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                      2⤵
                        PID:4292
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
                        2⤵
                          PID:4524
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
                          2⤵
                            PID:452
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3660
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
                            2⤵
                              PID:2904
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
                              2⤵
                                PID:2736
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
                                2⤵
                                  PID:2292
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1768869607325782697,8630692022840139650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
                                  2⤵
                                    PID:3672
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:5028
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3736

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      a8e767fd33edd97d306efb6905f93252

                                      SHA1

                                      a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

                                      SHA256

                                      c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

                                      SHA512

                                      07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      439b5e04ca18c7fb02cf406e6eb24167

                                      SHA1

                                      e0c5bb6216903934726e3570b7d63295b9d28987

                                      SHA256

                                      247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

                                      SHA512

                                      d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      336B

                                      MD5

                                      fea6d2588bbe6a25966d75ee1573c4bf

                                      SHA1

                                      66fc282970b3559e4beb6d858a2e3a93c13bd781

                                      SHA256

                                      43977b60530a0dadc30f96b3f2ae5bc6b769a147b16ea526be1595f3e8c598e3

                                      SHA512

                                      54eae75666f4af53c190979b0aaf612c5a7f207fa297b5987c65864c82a050a591c4b0480f3863ddd9b8042946ef4987e12f6a64ba3efaa738adc3f483219ae6

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      9f66f19feaf522843b8f4b059b091456

                                      SHA1

                                      d1cf822423eea795540849acf51b826d89a608a1

                                      SHA256

                                      a2f617548ed79b2100d0ab99f8d71bca507683da72d11082d0c1bf3d7e865ac3

                                      SHA512

                                      9c651512a9339fc9eaee4870c9cca984a4bcf9a7d15f9632c47e4fc2b70e0d54b1be91da90dd86ca64ad6547789211c91ee37d8a8b77e28efe48ce30ae70fac0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      ad3a49ac0a1dfddf8b5e1ed8dcf02e28

                                      SHA1

                                      6a10bca6d68d65442a35cfd2952510f6dbad0517

                                      SHA256

                                      13779671e34256b690522b674c6fd27f83cbbd397738d9db10d265eb9930f01a

                                      SHA512

                                      19beb59149e9c7305ce5dd5d6d70e721b2fffe57df6e1869ce0426f47c4376f0be5ab2d0a41ce067266b89911effc977c68792ba98946084b5a4f8bb9cf5f5e1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      4b69dbc1b13c0bd74c43c28e0004f09d

                                      SHA1

                                      e122a77da9c930b7deb99a7c7bcc8bcb0cf6eaab

                                      SHA256

                                      f4aa54c64fc04f60f2e9bf57455db0256ef799d8f8a6cc63c8aa29233f2808b1

                                      SHA512

                                      8f54c5e6d12156d7362ba2f21571debf9f68e984692059b26ed10031b13ced1b32abd1b34a7d9b0e9b8a5feac10640943036bf574c00da59aa53f00c009639cf

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      206702161f94c5cd39fadd03f4014d98

                                      SHA1

                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                      SHA256

                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                      SHA512

                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      567e938786e2394769377d22328fed7f

                                      SHA1

                                      fa4a96286602b934e03b1c42a485e169450aa611

                                      SHA256

                                      3cecfe176f3fbbfb97fcc48a2d6af81feda6fd153761ef198a7f6a6d527bc186

                                      SHA512

                                      ed3b29e5d0d6353abed6a2767540c3c79e5a040123e74d2de1ac0b8325f95d1ac1e998c47a735338508e3bd9120e2b809faebc69a749a15e64217eae5d591256

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                      Filesize

                                      2B

                                      MD5

                                      f3b25701fe362ec84616a93a45ce9998

                                      SHA1

                                      d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                      SHA256

                                      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                      SHA512

                                      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84