hxxps://corasa[.]com[.]ec/iecs/General%202022/index[.]html

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://corasa.com.ec/iecs/General%202022/index.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4092	msedge.exe
4092	msedge.exe
832	identity_helper.exe
832	identity_helper.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 632	4092	msedge.exe	83
PID 4092 wrote to memory of 632	4092	msedge.exe	83
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 1268	4092	msedge.exe	84
PID 4092 wrote to memory of 4560	4092	msedge.exe	85
PID 4092 wrote to memory of 4560	4092	msedge.exe	85
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86
PID 4092 wrote to memory of 1144	4092	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://corasa.com.ec/iecs/General%202022/index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb61104718
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2328,7978443615142977704,18133195574537923529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
043733987b9012b8d817ecadc238a9a6

SHA1
9025a6c8afceff5176edb19aae5f26545a1578fd

SHA256
b441cd0945d14bffc540dc73385c861f8cf820112c9a3d0ae708e43d1b72c957

SHA512
45d937ecd07a422aa3fbdc7f132d50c6ec87ef37fca877d007f89bef741c11eb8949e3310ffc257458961ca958658983603e71bcd36ccc4c38118cc0f49c63c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d2bed15fd2ad59c1f8df67f61eda0a19

SHA1
a44f1d292d7e96d1b0762ceea2ad391bbfaef046

SHA256
d43b30f66bc544cd181d5f17ce980c77e4c2ef66b11ccf32f4f1f9c617a98829

SHA512
ad9265dc57f346580cf14410064da465c64642c3ce000800112756a1518dc22a79c224d2318831355026e975007962053e71de9f5d099a044f79166d193de869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e6b88c18be8373596013477ac56b67e

SHA1
affce2603d410163cf86bd9d1d8423cdb9baefd4

SHA256
39872a44e0e74cb191f063acaebd0edc9cfe76648fd05e5b693db4aa522ce187

SHA512
47e4227b7226460efead3dd6995aaa609433eb6b2ee11b55b524f7b09bd7205a91158c640466302f538ff6de777503810de29fe00e9d02f0df59241c75a0664a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88e4f14aaf2e907ca3c7e8baadbbc364

SHA1
ab39b72c7f4575d86e65542ea5fcefe963379273

SHA256
90dcdb59db585546cfc06940f3387acde3649979cf41d36c909d26f800005498

SHA512
e0ae7c631c839302e83edccbea53025e32a2997e3f7a65b27fcdfa8f953551583fe7da3d0324ceb688fa59c6ccc0e9607b863b1e5b7d19235746933e79f4e961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
65b01693ced3ae6a7b8166575fc8a49e

SHA1
69b579f8b726ef1a18e451602312b71bfc66dfd3

SHA256
19ee270c5e427d0c8be19fb5e6bfd4a3e1673a751608dd781cb1bd13d13f5d76

SHA512
5d550054546f6bc2c994d24592b1fe20466f6a61debba1dcd1e1fadc0ca87850328b775c51d19cc4aad76c214de66290327f863ebc4b407fb6ae26afe47a3503

Download Submit