hxxps://user-logln[.]net-protected[.]net/en/?code=13c4c002dc83ccb2ab4d0dd0530c2aa2

Resubmissions

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://user-logln.net-protected.net/en/?code=13c4c002dc83ccb2ab4d0dd0530c2aa2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1944	msedge.exe
1944	msedge.exe
1240	msedge.exe
1240	msedge.exe
1528	identity_helper.exe
1528	identity_helper.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1240 msedge.exe
1240 msedge.exe
1240 msedge.exe
1240 msedge.exe
1240 msedge.exe
1240 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1240 wrote to memory of 1568	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1568	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1380	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1944	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1944	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 4956	1240	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://user-logln.net-protected.net/en/?code=13c4c002dc83ccb2ab4d0dd0530c2aa2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa63f046f8,0x7ffa63f04708,0x7ffa63f04718
2⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
2⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
2⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
2⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
2⤵
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
2⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
2⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4683834240326561153,12074108289667434366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
39be04945650a291d15ae875a70afe2c

SHA1
581faf93dd1ffd2052c721e7afd45e71e0bc850a

SHA256
6b60b09f7fbc513703588a1906c38e81c17f4d49fc9609e9971432d58278c4d4

SHA512
19e289a17906caa78710038cd2fbaf585722b061986f6050a2fd35139be668e1be15ee729ea440a2a14bb2b7a2fb97aaedc1ee715416a0883fbdade040463c09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
341B

MD5
0d058a51749215956705b4b6e88ceadb

SHA1
9d9a02b4ef4f4732ed93424ebbe8d0e0175a4258

SHA256
d80c897d1df9620d6f47cc397d3f233d59bd1ffa6943ccfcaab429b3096075b1

SHA512
3742a8a7e1c1a14850cd33a798689abe54c36e49493d0a0a50a0b88e573d28e26ab532da5192eb24fa45313c3f40a798582be415944fafbbc35b680a2da7ffbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
63ee960a4a2385ef857807c47412613e

SHA1
b20ce14218033f15d6f7da86571b8bfb0af5b98e

SHA256
660f38e64e0a02b1393ac244aafd92668667e217dd134802d8629dbff985d03b

SHA512
1c88d323cafb4037704fb33a0f745de3e214fe430a1ef891f4257d7e3ff077fa8b46c0b67df735e6c2438cc0a28deca3022e96c521f919c57a20acdb95322b95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9c9233bb53923ac6015b416c9f6d312d

SHA1
a65a78514fb2be5d132b6c00d0ee5f4924b528db

SHA256
2ec57d49c9b6f1be47a611f7d95d7b32d116f2156c8a79c5f1495e7e267a91ea

SHA512
cff54e0adb74ffd7933136f334b59b62146a67b9cb1e1ebd9dda041ff023710a958bab84bbed9ab31d1e9d37b5eb420afe1e7533f051b7423b7ea5d191c1cf79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
8108955b819ad80c2092370a99326704

SHA1
ff320130fa0d639261e2c45534cd6f4a041eda71

SHA256
964c4b10e6f2ed420152bbbe924d9d9cd9ee7806ad02883b4a52f3fe11add01f

SHA512
561315982958734a8876b04e3f333b2098b543a33447b6c839a0f1b2bb96baf6e929f8af846036fd38c2a5410007a20ed0b28b9967887ddf5375ab4c4e85bdab

Download Submit
\??\pipe\LOCAL\crashpad_1240_SGIIZIZLDBYDVIYP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit