hxxps://nc-card50[.]ru/50

Resubmissions

08-06-2024 14:28

240608-rtcm7adc98 10

08-06-2024 14:21

240608-rn53jscd5y 10

Analysis

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08-06-2024 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nc-card50.ru/50

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
556	msedge.exe
556	msedge.exe
2820	msedge.exe
2820	msedge.exe
2724	msedge.exe
2724	msedge.exe
1492	identity_helper.exe
1492	identity_helper.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2820 msedge.exe
2820 msedge.exe
2820 msedge.exe
2820 msedge.exe
2820 msedge.exe
2820 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2820 wrote to memory of 3720	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 3720	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 4532	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 556	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 556	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe
PID 2820 wrote to memory of 2508	2820	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nc-card50.ru/50
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9c29f3cb8,0x7ff9c29f3cc8,0x7ff9c29f3cd8
2⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
2⤵
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
2⤵
PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
2⤵
PID:428

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5164 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9faad3e004614b187287bed750e56acc

SHA1
eeea3627a208df5a8cf627b0d39561167d272ac5

SHA256
64a60300c46447926ce44b48ce179d01eff3dba906b83b17e48db0c738ca38a9

SHA512
a7470fe359229c2932aa39417e1cd0dc47f351963cbb39f4026f3a2954e05e3238f3605e13c870c9fe24ae56a0d07e1a6943df0e891bdcd46fd9ae4b7a48ab90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7915c5c12c884cc2fa03af40f3d2e49d

SHA1
d48085f85761cde9c287b0b70a918c7ce8008629

SHA256
e79d4b86d8cabd981d719da7f55e0540831df7fa0f8df5b19c0671137406c3da

SHA512
4c71eb6836546d4cfdb39cd84b6c44687b2c2dee31e2e658d12f809225cbd495f20ce69030bff1d80468605a3523d23b6dea166975cedae25b02a75479c3f217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
0ab8258367d9b6da345f2cdd9ea5bdfc

SHA1
f88308d021294caf4234c8233eee30d9edc3f966

SHA256
fc5fe0b08fa0bc6caaed904d17e3411434ba7cc4495bba15cadde4a3f9543b64

SHA512
47b110bf6367f4abc1a94db32ae7f84f243ed7c6e3e80460689938b5c5799964b99f60bc945553393a00829766bd9f942bfcb8c564fd8811225587cbacc82660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
331B

MD5
7fbaddf6475416842b901760c16e9ca6

SHA1
6283af713d7d3a256994d7c9743de6fed0056514

SHA256
18a21fd507c95d825167de0e2a88ec60bd17dff72410b18d8bff2d4626cdc49c

SHA512
2588ae3cd828652a0d96395a2f9362b13d646661d66915f82164acc4bd1817d2a771acaace9c450755bc3dfa8ae6528153e0242d8b5ff3424b627945bee8345a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
207cc497a73053035177db52fdc82b7f

SHA1
9a19b878ae8e3acc20bbcdd6f3928d86a53485a1

SHA256
57ba1e7dfb92b162a9540edd894a3924a1933f60d896dae570ebb893d3f5de5d

SHA512
ef046107ad6b5b08ab1f93953cd2602e3d6c3862653be4cea77d772a032c930eff77101a1445a69454ede710eb55304a67228768cb235dd8cb7f2a285ad2846c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
56a1819b4200dc7d014201dd9c15fabb

SHA1
eb8209478cfcd634958ab49f3b53fbe64df3df1f

SHA256
30460aaabd66bb42eed9000f67a2d91a92764b0b9ffef9c6ae35c0ccc0879f14

SHA512
42c1d7ac340dd81c13e5dbc127c4774765a6b002cb077e56be0015eb5bbd0f5271d700732d49120b4a5f21b59c36e277ee0300aac6cdd8682c0b719b1cd084bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
02d51172dad347929b0616503896496b

SHA1
cef70a746d43435cb12730eb2dbd867d761088b5

SHA256
a50a3dd7988b890542d00648a0aacf5d92aa56359ef265899a1c2c97e2f19e16

SHA512
0b8df8c69dc2feca2babbffdec0cc6e30a1c3b82152174b152e237c9e7477557decd18b53773b19e58e4f2649c0d7c048b40d904fafbd1e9d5f056e7c1b6670c

Download Submit
\??\pipe\LOCAL\crashpad_2820_PUWKTMZVIWUIIFYY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit