hxxps://nc-card50[.]ru/50

Resubmissions

08/06/2024, 14:28

240608-rtcm7adc9810

08/06/2024, 14:21

240608-rn53jscd5y10

Analysis

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nc-card50.ru/50
Sample240608-rtcm7adc98

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
2820	msedge.exe
2820	msedge.exe
2724	msedge.exe
2724	msedge.exe
1492	identity_helper.exe
1492	identity_helper.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3720	2820	msedge.exe	77
PID 2820 wrote to memory of 3720	2820	msedge.exe	77
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 4532	2820	msedge.exe	78
PID 2820 wrote to memory of 556	2820	msedge.exe	79
PID 2820 wrote to memory of 556	2820	msedge.exe	79
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80
PID 2820 wrote to memory of 2508	2820	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nc-card50.ru/50
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9c29f3cb8,0x7ff9c29f3cc8,0x7ff9c29f3cd8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,13854422472641820577,2076655679429181778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 64a60300c46447926ce44b48ce179d01eff3dba906b83b17e48db0c738ca38a9
MD5 9faad3e004614b187287bed750e56acc
SHA1 eeea3627a208df5a8cf627b0d39561167d272ac5
SHA512 a7470fe359229c2932aa39417e1cd0dc47f351963cbb39f4026f3a2954e05e3238f3605e13c870c9fe24ae56a0d07e1a6943df0e891bdcd46fd9ae4b7a48ab90
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e79d4b86d8cabd981d719da7f55e0540831df7fa0f8df5b19c0671137406c3da
MD5 7915c5c12c884cc2fa03af40f3d2e49d
SHA1 d48085f85761cde9c287b0b70a918c7ce8008629
SHA512 4c71eb6836546d4cfdb39cd84b6c44687b2c2dee31e2e658d12f809225cbd495f20ce69030bff1d80468605a3523d23b6dea166975cedae25b02a75479c3f217
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 fc5fe0b08fa0bc6caaed904d17e3411434ba7cc4495bba15cadde4a3f9543b64
MD5 0ab8258367d9b6da345f2cdd9ea5bdfc
SHA1 f88308d021294caf4234c8233eee30d9edc3f966
SHA512 47b110bf6367f4abc1a94db32ae7f84f243ed7c6e3e80460689938b5c5799964b99f60bc945553393a00829766bd9f942bfcb8c564fd8811225587cbacc82660
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 331B
SHA256 18a21fd507c95d825167de0e2a88ec60bd17dff72410b18d8bff2d4626cdc49c
MD5 7fbaddf6475416842b901760c16e9ca6
SHA1 6283af713d7d3a256994d7c9743de6fed0056514
SHA512 2588ae3cd828652a0d96395a2f9362b13d646661d66915f82164acc4bd1817d2a771acaace9c450755bc3dfa8ae6528153e0242d8b5ff3424b627945bee8345a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 57ba1e7dfb92b162a9540edd894a3924a1933f60d896dae570ebb893d3f5de5d
MD5 207cc497a73053035177db52fdc82b7f
SHA1 9a19b878ae8e3acc20bbcdd6f3928d86a53485a1
SHA512 ef046107ad6b5b08ab1f93953cd2602e3d6c3862653be4cea77d772a032c930eff77101a1445a69454ede710eb55304a67228768cb235dd8cb7f2a285ad2846c
SSDEEP 96:nzk35TIkf/AwSv0MoiVmdHIrJ30WQyV+VuziX3wI3:nzk3pIkfIv0MAIF3LM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 30460aaabd66bb42eed9000f67a2d91a92764b0b9ffef9c6ae35c0ccc0879f14
MD5 56a1819b4200dc7d014201dd9c15fabb
SHA1 eb8209478cfcd634958ab49f3b53fbe64df3df1f
SHA512 42c1d7ac340dd81c13e5dbc127c4774765a6b002cb077e56be0015eb5bbd0f5271d700732d49120b4a5f21b59c36e277ee0300aac6cdd8682c0b719b1cd084bc
SSDEEP 96:nzk3mTIkfVAwSv0MoiVmdmnunO1jIPEJ30WQyV+VpAiX3wI3:nzk3uIkfGv0MLuOhIK3Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a50a3dd7988b890542d00648a0aacf5d92aa56359ef265899a1c2c97e2f19e16
MD5 02d51172dad347929b0616503896496b
SHA1 cef70a746d43435cb12730eb2dbd867d761088b5
SHA512 0b8df8c69dc2feca2babbffdec0cc6e30a1c3b82152174b152e237c9e7477557decd18b53773b19e58e4f2649c0d7c048b40d904fafbd1e9d5f056e7c1b6670c
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGWJje2RUHORIcc7YvmljEW5jx:M9iIxuERzA83h09RZxASGozqRcc7Yk9/
MD5 SHA1 SHA512 SSDEEP

Submit Download