hxxps://synnovisportal[.]co[.]uk/account/login

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://synnovisportal.co.uk/account/login

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

5040 msedge.exe
5040 msedge.exe
712 msedge.exe
712 msedge.exe
2840 identity_helper.exe
2840 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

712 msedge.exe
712 msedge.exe
712 msedge.exe
712 msedge.exe
712 msedge.exe
712 msedge.exe

pid	process
5040	msedge.exe
5040	msedge.exe
712	msedge.exe
712	msedge.exe
2840	identity_helper.exe
2840	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 712 wrote to memory of 2696	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2696	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 4580	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 5040	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 5040	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2848	712	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://synnovisportal.co.uk/account/login
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ad3946f8,0x7ff8ad394708,0x7ff8ad394718
2⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
2⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
2⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
2⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
2⤵
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8003932189040799678,2049438202608707127,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
2⤵
PID:544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
360B

MD5
b310ab7e0babcbc532ebe65784485198

SHA1
7a9e3f4f39140104d0dcf77c59c6d673770c2f8b

SHA256
f5aa63ab37987ad8c84f1ae82018a7047b0016ad30c736633c6e8e413013d7ea

SHA512
a195437e0ca5a5c744d0ecf6196a541748d73269d6ae6bc96f83f657f25b081cb795e8843491e586f1283e90978e27a8fa45c113eb4841a5dc26c07ab5ac4d47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
844B

MD5
caf832e11b53d26d18b07c1248b8b0a4

SHA1
314b2b34d187734f819c45b9c59436e4ae6d7020

SHA256
780f12de8574cfe8f97fd9c932e29f4aecd4749f141d3441f502fa722b12e799

SHA512
ce536185edde6426b7215634d1dffd06f3820a756db93a7217bde5eefbbaa206bce1a9c5c32266e0ff813577e5161826f4bc64fe934020f4e9bf3a1488a2838f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9ec4e7c6294005e3f907df735aae32a6

SHA1
bb49e85af9e3f7293d550d5c14a4dbfd249d4460

SHA256
ef1855f9c05a18f8fac32ecff6af40308481c746f7c2a54195af610de8c78830

SHA512
7ad9e99a3f373169816d231634a59223a1d883af6ea0d02ec8c6b0e57c310cea65909034bf2fe20d3e76f45a7de04a56f0127afb1d358f51640e7cb1fbc04eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
36385c07b69cb1f927c624ebae06cdcb

SHA1
6a6887f18ca8ccd8cfc5c3f81c5700e42a494b91

SHA256
a6ca68e0458eb216155acecd1e92c647cd815e8ef105f74d2a3391420a769f98

SHA512
c2dff24afac4db59e37d2667afb1f87165fb53db8030bd41fb905f32531928d3e5ee0b35addb802e14f75d911da07a5d814d8c6f906e18042bbb67e3e753d96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
ca48b28a8c5d5b5d62a25beea73044a8

SHA1
0a5418b716f6d037f166c755fd6bb1d7df33b73e

SHA256
8adfa76514fd49f464475cdc66994aaf360173540afed9d87b7d74516dc06518

SHA512
2879a25713c376c6db5935e66a6a3e25d6fdc6d6f6ac5c1c8de52f49043be4a2e5a95f2090e222854886d6919ca0719545367583d84bc36c94a35ff5faf34c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a1ae.TMP
Filesize
48B

MD5
ad6cb44e4c4f3d67e6eeafaef70fcdef

SHA1
7bad85d6503b4242d70233d8c6d975e568a639dc

SHA256
f3d0aca3c0d76e68583c7d8cb8d7b8a20d2c20a71564d04488f4d4f3da5761b4

SHA512
ea6b4906fa0ff5b41c723556fd85d78b32755d9da9999a4e9d9cb57a323b1b713cb2501de5908777f95c94b4468a94f2b6b536f98779d5df64996dfe814082eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
b02a9ac2d70d3b4dca43bb04c2fc9837

SHA1
82c258d6161fc9c4b9753ca766912b26bc0657f6

SHA256
1c8b712c5b5d9c173e4c0e66d21d0d652366eaf474664af5eefe8614df54733e

SHA512
db058b2cc7a7fe9a2fb067d0962ce5a59b7756fc89ee5f9f54fc490248980b0438e150c5340dcf6a4961cf9e6602052326377e4d61be6884879e550a792df6b5

Download Submit
\??\pipe\LOCAL\crashpad_712_VLSGYNCPKDLPSGFM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit