hxxps://user-logln[.]net-protected[.]net/en/?code=13c4c002dc83ccb2ab4d0dd0530c2aa2

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://user-logln.net-protected.net/en/?code=13c4c002dc83ccb2ab4d0dd0530c2aa2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4260	msedge.exe
4260	msedge.exe
4552	msedge.exe
4552	msedge.exe
4272	identity_helper.exe
4272	identity_helper.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4552 msedge.exe
4552 msedge.exe
4552 msedge.exe
4552 msedge.exe
4552 msedge.exe
4552 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4552 wrote to memory of 2616	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 2616	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4536	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4260	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4260	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4132	4552	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://user-logln.net-protected.net/en/?code=13c4c002dc83ccb2ab4d0dd0530c2aa2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6dc846f8,0x7fff6dc84708,0x7fff6dc84718
2⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
2⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
2⤵
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
2⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
2⤵
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
2⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
2⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
2⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,3182379052223134168,14362793799344467461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2740

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
aafb753b76f21d8d17ce4d46392b3cf5

SHA1
a963b18fb98d4450971bc618c3e451c9fff08b2b

SHA256
63dd7f5850dd9caff67c87b6b6dfde820e4a72e60ad0010453b1f7e50d060b89

SHA512
4cd8e480575cebc83d7439bb5975ab0cce3e0ee2424baec0c9d248286289363b98f8ec0640a9138b131a3377c8fd70e883ee951f3908deeaec2236d21e5ef634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
341B

MD5
0d058a51749215956705b4b6e88ceadb

SHA1
9d9a02b4ef4f4732ed93424ebbe8d0e0175a4258

SHA256
d80c897d1df9620d6f47cc397d3f233d59bd1ffa6943ccfcaab429b3096075b1

SHA512
3742a8a7e1c1a14850cd33a798689abe54c36e49493d0a0a50a0b88e573d28e26ab532da5192eb24fa45313c3f40a798582be415944fafbbc35b680a2da7ffbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
e47c33d055ac8b19f94646a5a8ce0cbc

SHA1
6899e784aedbaa3f01c29b10dad020fecf7752f9

SHA256
81305c64facccce4eda286e24ff3e090e71867f45479ac508a4a1bc602c8ea44

SHA512
4acbd30458ef9bbbf3e982e2422597804363af7e5e279728fc22d1ea97897dd1a6a3254f6878e60603722cb3f96a970ccd5d5b75df36443368e0dfc94a343a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ee9b8004d13e80b743974e78d5bd305c

SHA1
b58ad0df190e0d70aaba6fa6855a125242f5dd7f

SHA256
e29618e8db76a60d77d50baecdaa9254b6c6502b8830bf930784d19cb885a356

SHA512
f1b2e7391f8174f8cb18cf83f594430115b4974b12dd519d3649071617d4011c73e1689b0f00cfba5f2ccc26b0462014e5603296f42434b31d2025d429d61d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
9bcafb53b85a7fdaf8d168347fba4377

SHA1
37f980e5079e7ba7d04327d608c84a872865d2c5

SHA256
a506b32d08380ab755a01f29d42680b6a802f2ef72a2302c7f20272c836fcf9d

SHA512
10a9b1c209200c39afb6aab2713c4b6fe2cbe2b65bf6bca9e4013c9f1664b06057c36d9a53b97703a3b0c2d03de15ad7fb3450475874040b40e96d39041aa447

Download Submit
\??\pipe\LOCAL\crashpad_4552_LNHXQNPDLJUYAZFD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit